VulnSocial

CVE-2026-121426

LOWCVSS 8.3 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that ends an angle-addr at a '>' inside a quoted local part, comment or domain literal. Attackers can submit addresses that validate as an allowed domain but are delivered to an attacker-controlled domain, bypassing recipient allow lists and disclosing message content.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-20

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-11-03: 111-03
Full discourse1 post
  • Upwind Security MDR@UpwindMDR

    🚨High - Nodemailer addressparser Flaws Enable Mail Redirection (CVE-2026-121424, CVE-2026-121425, CVE-2026-121426) Parsing bugs in nested comments, address groups & angle addresses let crafted email addresses bypass recipient allow lists and redirect mail to attacker-chosen recipients. 👉Affected: Nodemailer 3.0.0 - 10.1.3 | Upgrade to 10.1.4

    0000078
    380 followersView on X

Explore more

Back to dashboard