CVE-2026-110870Nodemailer before 10.0.13 Improper Input Validation via Angle-Bracket Address Comments

Açıklama

Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal characters reach envelope.to and RCPT TO, causing rejected delivery or parser interpretation conflicts that bypass domain allow-lists.

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Kaynaklar ve yamalar

• GitHub Security Advisory (GHSA-g73g-hqqh-jr95) vendor-advisory
• VulnCheck Advisory: Nodemailer before 10.0.13 Improper Input Validation via Angle-Bracket Address Comments third-party-advisory