Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| nodemailer | nodemailer | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Wed, 14 Oct 2026 23:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal characters reach envelope.to and RCPT TO, causing rejected delivery or parser interpretation conflicts that bypass domain allow-lists. | |
| Title | Nodemailer before 10.0.13 Improper Input Validation via Angle-Bracket Address Comments | |
| First Time appeared |
Nodemailer
Nodemailer nodemailer |
|
| Weaknesses | CWE-20 | |
| CPEs | cpe:2.3:a:nodemailer:nodemailer:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Nodemailer
Nodemailer nodemailer |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-10-14T22:52:58.787Z
Reserved: 2026-10-14T22:21:21.397Z
Link: CVE-2026-110870
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-14T23:17:28.813
Modified: 2026-10-14T23:17:28.813
Link: CVE-2026-110870
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-20
Improper Input Validation