VulnSocial

CVE-2026-121425

LOWCVSS 8.3 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon inside quoted display names or comments. Attackers can submit crafted group addresses that conformant validators approve, redirecting mail to attacker-chosen recipients and bypassing recipient allow lists.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-20

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-11-03: 111-03
Full discourse1 post
  • Upwind Security MDR@UpwindMDR

    🚨High - Nodemailer addressparser Flaws Enable Mail Redirection (CVE-2026-121424, CVE-2026-121425, CVE-2026-121426) Parsing bugs in nested comments, address groups & angle addresses let crafted email addresses bypass recipient allow lists and redirect mail to attacker-chosen recipients. 👉Affected: Nodemailer 3.0.0 - 10.1.3 | Upgrade to 10.1.4

    0000078
    380 followersView on X

Explore more

Back to dashboard