CVE-2026-121426

MediumCVSS 6.5/10Last modified Nov 7, 2026

Description

Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that ends an angle-addr at a '>' inside a quoted local part, comment or domain literal. Attackers can submit addresses that validate as an allowed domain but are delivered to an attacker-controlled domain, bypassing recipient allow lists and disclosing message content.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-20

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 3, 2026
Last modified
Nov 7, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1214277.5AzuraCast through 0.23.8 fails to remove frontend_config.custom_config in PUT /station/{id}/profile/edit for users lacking the Manage statioCVE-2026-1214288.8AzuraCast through 0.23.8 contains a remote code execution vulnerability that allows authenticated station managers to inject Supervisor confCVE-2026-1214298.8AzuraCast through 0.23.8 contains a command injection vulnerability that allows station users with Profile permission to execute OS commandsCVE-2026-121437.5form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#appenCVE-2026-1214305.4AzuraCast before 0.24.0 contains a missing authorization vulnerability in the GET and POST /api/station/{station_id}/waveform/{media_id} rouCVE-2026-1214315.3AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows station users with WebHooks permission to bypass thCVE-2026-1214323.5AzuraCast before 0.24.0 contains a CRLF injection vulnerability that allows low-privilege station users to inject playlist entries by embeddCVE-2026-1214335.4AzuraCast before 0.24.0 contains a stored CSV formula injection vulnerability that allows station users with Media permission to persist forCVE-2026-1214345.4Froxlor 2.3.0 before 2.3.15 contains a missing authorization check in the Certificates.add and Certificates.update API commands, which do noCVE-2026-1214354.3Froxlor before 2.3.15 contains an authorization bypass vulnerability that allows authenticated customers to create MySQL databases by callinCVE-2026-1214367.2Froxlor from 2.3.8 before 2.3.15 contains an information disclosure vulnerability that allows administrators with customers_see_all to view CVE-2026-1214377.5Mistune from 3.3.0 before 3.3.4 contains a denial of service vulnerability that allows remote attackers to exhaust CPU through quadratic-tim
CVE-2026-121426: Medium severity, CVSS 6.5 | Vulnix