Nodemailer EUVD-2026-115958

Exploitation requires an application that (1) passes attacker-influenced address text (e.g. a To value from a contact/invite form, or a header parsed via mailparser) to Nodemailer, and (2) enforces a recipient allow list or domain restriction validated with a conformant parser or domain check - that allow-list boundary is the specific control bypassed. The exact trigger value is an address of the form <"a@evil.com>"@good.com>, where a '>' inside the quoted local part (or a comment/domain literal) prematurely ends the angle-addr. No application access, configuration, credentials, or user interaction is needed. Limiting factors: only applications implementing this allow-list/domain-validation pattern are meaningfully affected (the crafted value is harmless where any recipient is permitted), and only Nodemailer versions 3.0.0 through 10.1.3 are vulnerable; consumers of the standalone addressparser such as mailparser are also affected.

This is a genuine, above-average-priority issue but not a drop-everything emergency, and the signals mostly agree. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N, 8.3) shows a network-reachable, unauthenticated flaw with high confidentiality impact (disclosure of message content) but a meaningful precondition captured by AC:H and AT:P - the target application must enforce a recipient allow list or domain check that the crafted address slips past. The vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a serious but conditional weakness. No EPSS score was supplied, and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation - treat it as 'no confirmed active exploitation' rather than a widely-attacked bug. A concrete proof-of-concept IS present in the vendor (GHSA) advisory demonstrating the parser discrepancy, so exploitability is well-established in principle even though weaponized in-the-wild use is not. Net: a real and credible allow-list/domain-confusion bypass affecting a very widely used library, warranting prompt patching, but the dependence on an application-side allow-list pattern keeps real-world blast radius narrower than the 8.3 alone suggests.

An application restricts outbound invitations/notifications to an allowed domain and validates the user-supplied recipient with a conformant RFC 5322 parser or domain check. An attacker submits <"a@evil.com>"@good.com>, which validates as a good.com mailbox, but Nodemailer ends the angle-addr at the '>' inside the quoted local part and issues RCPT TO to evil.com, delivering the message content to the attacker's domain. A working PoC exists in the vendor advisory showing the parse divergence.