CVE-2026-125755
6.5 MEDIUMpublic exploit availablePublished 2026-11-10 · Updated 2026-11-10
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Nodemailer 3.0.0 before 10.4.1 contains an address parsing flaw in addressparser that truncates domains at folding whitespace or comments before a dot, allowing attackers to bypass recipient domain restrictions. Attackers can submit crafted to, cc, bcc or replyTo addresses that pass RFC 5322 domain checks but deliver mail to an attacker-chosen address under the application's sender identity.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Weaknesses
CWE-436
Public exploit & PoC references
- https://github.com/nodemailer/nodemailer/blob/3b5cf1eec32c81f287870c8a1c9c09640062cfd5/src/addressparser/index.ts#L330-L345
- https://github.com/nodemailer/nodemailer/commit/c2b9c41bb81b2294ebadd294ad15ff035a17d0a5
- https://github.com/nodemailer/nodemailer/releases/tag/v10.4.1
- https://github.com/nodemailer/nodemailer/security/advisories/GHSA-3q53-mvfw-q9v8
All references
- https://github.com/nodemailer/nodemailer/blob/3b5cf1eec32c81f287870c8a1c9c09640062cfd5/src/addressparser/index.ts#L330-L345
- https://github.com/nodemailer/nodemailer/commit/c2b9c41bb81b2294ebadd294ad15ff035a17d0a5
- https://github.com/nodemailer/nodemailer/releases/tag/v10.4.1
- https://github.com/nodemailer/nodemailer/security/advisories/GHSA-3q53-mvfw-q9v8
- https://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.4.1-recipient-allow-list-bypass-via-addressparser
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2026-100351PoC
- MEDIUMCVE-2026-101019
- HIGHCVE-2026-103866
- HIGHCVE-2026-104269PoC
- MEDIUMCVE-2026-106430
- HIGHCVE-2026-106505PoC
- MEDIUMCVE-2026-107825PoC
- MEDIUMCVE-2026-107835PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.