Nodemailer CVE-2026-121424

Exploitation requires that the application pass attacker-influenced address text to Nodemailer (e.g. the to/from fields of sendMail) OR that an inbound message's From/To header be parsed with mailparser; no access to the application, its configuration, or its credentials is needed, and the malicious value is a syntactically valid RFC 5322 address that conformant parsers accept without defects. The impact is bounded by a specific deployment pattern: it only matters where a conformant validator enforces a recipient allow list or a sender/author check (e.g. a DMARC or display layer), since that is the boundary the nested-comment bypass crosses - applications that do not allow-list recipients or check authors gain no new exposure. Affected versions are 3.0.0 through 10.1.3; the only complete fix stated by the vendor is upgrading to 10.1.4, which counts comment depth and ends a comment only at the parenthesis closing the outermost one.

Using all signals: the vendor CVSS 4.0 base score is 8.3 (High) with vector AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N - network-reachable and requiring no privileges or user interaction, but carrying AT:P (and AC:H) that reflect a genuine attack requirement, namely that the target application must perform conformant RFC 5322 validation/allow-listing for the bypass to matter. No EPSS score is present in the provided data and there is no CISA KEV listing, so this is not confirmed actively exploited; a public PoC reference exists (working demonstration code is embedded in the GHSA advisory) proving the parser misbehavior, but PoC availability is not the same as in-the-wild exploitation. The vuln.today Decision label is this_week (not act_now/emergency), which is consistent with: real and concrete impact (recipient redirection / sender spoofing bypassing allow lists) but gated by deployment conditions rather than a mass-exploitable default-config RCE. Net: a legitimate priority to patch this week for anyone passing user-influenced addresses to Nodemailer or consuming mailparser, but its real-world blast radius depends on whether the application relies on recipient allow-listing or author checks - where it does not, exposure is limited.

An application validates a user-submitted address with a conformant RFC 5322 parser and permits only its own domain; the attacker submits Victim (x(y) <evil@evil.com>) <v@victim.com>, which the validator accepts as v@victim.com, yet Nodemailer's addressparser ends the nested comment at the first ) and delivers the mail to evil@evil.com. A public proof-of-concept demonstrating this exact divergence is included in the GHSA advisory. Because AV:N/PR:N/UI:N, the attacker only needs to control the address text - no application access, configuration, or credentials - though exploitation materializes only where allow-list or author-check validation is in play.