What is CVE-2026-121424?

CVE-2026-121424 is a medium-severity vulnerability in Nodemailer, classified under Improper Input Validation. CVSS score: 6.5/10. Published 2026-11-03.

How severe is CVE-2026-121424?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Improper input validation in Nodemailer

CVE-2026-121424

Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect recipients by ending nested RFC 5322 comments at the first closing parenthesis. Attackers can submit addresses whose nested comment hides an attacker address, bypassing conformant validators and recipient allow lists to receive mail or spoof senders in mailparser.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

Published 2026-11-03 · last modified 2026-11-03.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Nodemailer

Weakness classification (CWE)

CWE-20 — Improper Input Validation

References

github.com/nodemailer/nodemailer/security/advisories/GHSA-8c8m-p3m8-cjg8 (vendor-advisory)
www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.1.4-address-parsing-byp… (third-party-advisory)

Frequently asked questions

What is CVE-2026-121424?: CVE-2026-121424 is a medium-severity vulnerability in Nodemailer, classified under Improper Input Validation. CVSS score: 6.5/10. Published 2026-11-03.
How severe is CVE-2026-121424?: Medium severity. CVSS v3 base score is 6.5 out of 10.