CVE-2026-110870

Awaiting Analysis Awaiting Analysis - Queue

Nodemailer Address Parser RFC 5322 Comment Injection Flaw

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: VulnCheck

Description

Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal characters reach envelope.to and RCPT TO, causing rejected delivery or parser interpretation conflicts that bypass domain allow-lists.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110870

EUVD

EUVD-2026-101753

Affected Vendors & Products

Vendor	Product	Version / Range
nodemailer	nodemailer	3.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

Nodemailer versions from 3.0.0 before 10.0.13 have an improper input validation flaw in the address parser. It fails to remove RFC 5322 comments inside angle-bracket addresses. Attackers can craft email recipients with comments in the domain part, like 'user@domain (comment)', causing illegal characters to reach envelope.to and RCPT TO commands. This leads to delivery rejections or parser conflicts that bypass domain allow-lists.

Detection Guidance

To detect this vulnerability, inspect Nodemailer versions in use. Check for versions between 3.0.0 and 10.0.12. Commands like 'npm list nodemailer' or 'npm list -g nodemailer' can help identify installed versions. If affected, update to version 10.0.13 or later.

Impact Analysis

This vulnerability can cause email delivery failures or bypass security controls like domain allow-lists. Attackers may exploit it to send emails that appear legitimate but are rejected by mail servers, disrupting communication. It could also allow bypassing restrictions in email filtering systems.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized email recipients or bypassing domain allow-lists, which may lead to improper data handling or disclosure. The improper input validation in address parsing could cause mail delivery failures or misinterpretation of recipient addresses, potentially violating data protection requirements.

Mitigation Strategies

Update Nodemailer to version 10.0.13 or later to address the improper input validation issue in the address parser.

Hi! I’m here to help you understand CVE-2026-110870. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70