Nodemailer CVE-2026-110870

Requires a deployment using Nodemailer 3.0.0 through 10.0.12 that accepts attacker-influenced recipient address strings AND relies on domain allow-list checks or envelope validation on the parsed address; the attacker supplies a display-name/angle-bracket address containing a parenthesized comment in the domain. The limiting factor is that impact only materializes where such allow-list or envelope enforcement exists - in applications without domain filtering the flaw merely causes rejected or malformed delivery. Exploitation is remote and unauthenticated per the CVSS vector (PR:N), but depends on the host application passing untrusted recipient input to the vulnerable parser.

This is a moderate, integrity-only issue rather than a top-priority emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) with vulnerable-system impact of only VI:L (and VC:N/VA:N) yields 6.9 (Medium), which aligns well with the description: the flaw lets an attacker influence the parsed recipient (envelope.to / RCPT TO) but does not expose confidential data, grant code execution, or cause denial of service. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so all three of the strongest real-world-exploitation signals are absent - this points to no evidence of active exploitation at this time. The practical impact is conditional: it only matters where an application built on Nodemailer relies on domain allow-lists or envelope validation that this parser confusion can subvert; absent such controls the worst outcome is rejected/garbled delivery. Net: a legitimately network-reachable, unauthenticated, low-complexity bug, but low technical impact and no exploitation evidence keep it well below critical priority. The input 'Authentication Bypass' tag overstates this - the advisory describes a domain allow-list / envelope-injection bypass, not credential authentication bypass.

An attacker submits a recipient address to an application that uses a vulnerable Nodemailer version and enforces a domain allow-list, e.g. a display name plus an angle-bracket address carrying a parenthesized RFC 5322 comment in the domain. Because the parser fails to strip the comment, illegal characters survive into envelope.to and the RCPT TO command, so the effective domain differs from what the allow-list check saw, bypassing it or breaking delivery. No public proof-of-concept was provided.