CVE-2026-110870 — Nodemailer before 10.0.13 Improper Input Validation via Angle-Bracket Address Comments
Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket address…
Published: 2026-10-14 · CVSS: 6.9 · CVSS 4.0
Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal characters reach envelope.to and RCPT TO, causing rejected delivery or parser interpretation conflicts that bypass domain allow-lists.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7