CVE-2026-121425 nodemailer CVE debrief

Who should care

Defenders responsible for email applications using Nodemailer, email service providers, and developers integrating Nodemailer into their projects should assess exposure and verify versions.

Why it matters

CVE-2026-121425 allows attackers to manipulate email recipients, potentially leading to unauthorized email sending and phishing attacks. Defenders should verify Nodemailer versions and review address validation mechanisms.

• Potential for email spoofing and phishing attacks
• Bypass of recipient validation mechanisms
• Increased risk of targeted attacks via email
• Potential for unauthorized email sending

Technical summary

The addressparser in Nodemailer incorrectly handles address groups, allowing an attacker to turn display text into a recipient by injecting a ';' character inside a quoted string or comment. This vulnerability can be exploited by an attacker controlling the text of an address field passed to Nodemailer or the header of an inbound message parsed with mailparser, without needing access to the application, its configuration, or credentials. The vulnerability affects Nodemailer versions 3.0.0 through 10.1.3 and can lead to unauthorized email sending and phishing attacks.

Defensive priority

Defenders should prioritize verifying and updating Nodemailer versions to prevent potential address spoofing

Recommended defensive actions

• Verify Nodemailer version and update to 10.1.4 or later
• Review and validate address fields passed to Nodemailer
• Monitor for suspicious email activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability exists in the addressparser of Nodemailer, affecting versions 3.0.0 through 10.1.3. An attacker can control the text of an address field passed to Nodemailer or the header of an inbound message parsed with mailparser, without needing access to the application, its configuration, or credentials.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.