Nodemailer CVE-2026-121425

Requires an application that passes attacker-influenced address text to Nodemailer (e.g. sendMail to/cc/bcc), or a consumer of the standalone addressparser/mailparser that parses attacker-controlled message headers, AND that relies on a separate conformant RFC 5322 parser to validate recipients against an allow list - the bypass only has security value where such upstream allow-list enforcement exists. The concrete trigger is a syntactically valid RFC 5322 group containing a ';' inside a quoted display name or a comment (e.g. G: (a; <evil@evil.com>) <v@victim.com>;), which conformant validators read as the single mailbox v@victim.com. LIMITING factors: affected versions are 3.0.0 through 10.1.3 only (fixed in 10.1.4); the attacker must control the address-field text; and exploitation yields benefit only where recipient validation/allow-listing is performed with a conformant parser - an application with no allow list gains no boundary to cross.

Signals are moderately strong but not uniformly severe. The input CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N, 8.3) describes a network-reachable, unauthenticated flaw (PR:N) whose exploitation carries elevated attack complexity and a specific attack requirement (AC:H/AT:P) - consistent with the vendor's own framing that the bypass only bites when an upstream conformant validator plus a recipient allow list are present. Impact is confidentiality-weighted (VC:H: intended mail content is disclosed to an attacker-chosen recipient) with limited integrity (VI:L: the intended recipient is silently dropped) and no availability impact. The vuln.today priority is 'this_week' (not act_now/emergency). KEV status is not present in the input, so this is not confirmed as actively exploited; per the precision rules this is 'no public exploit identified' ONLY if there were no PoC - but the GHSA advisory embeds a working demonstration PoC, so a public PoC reference does exist. No EPSS score was supplied, so widespread-exploitation probability cannot be weighed - STATE EXPLICITLY: EPSS is missing from the provided data. Net: this is a genuine, well-characterized recipient-injection/allow-list-bypass that merits prompt patching for any Node.js application that validates attacker-influenced recipient lists, but the AC:H/AT:P preconditions and absence of KEV/EPSS argue for targeted rather than mass-exploitable risk - not an all-environments emergency.

An application lets a user supply a recipient address, validates it with a conformant RFC 5322 parser, and only permits addresses in its own domain. The attacker submits the group value G: (a; <evil@evil.com>) <v@victim.com>;; the validator sees the single approved mailbox v@victim.com and allows it, but Nodemailer's addressparser ends the group early at the semicolon inside the comment and issues RCPT TO for evil@evil.com, redirecting the intended mail (and its content) to the attacker. The GHSA advisory includes a runnable demonstration PoC (both a comment and a quoted-string variant); it is a demonstration of the misparse, not verified weaponized exploit code.