Recipient Domain Bypass in Nodemailer Products

CVE-2026-125755

What is CVE-2026-125755?

Nodemailer versions prior to 10.4.1 contain an address parsing flaw in the addressparser function, which allows for a recipient domain bypass. This vulnerability enables attackers to exploit folding whitespace or comments before a dot in email addresses. As a result, crafted addresses in the 'to', 'cc', 'bcc', or 'replyTo' fields could pass standard domain checks while redirecting mail to an attacker-controlled address, thus masking the actual sender's identity. This poses significant risks for applications utilizing Nodemailer as it undermines the integrity of email communications.

References