CVE-2026-121424: 
Grafana vulnerability analysis and mitigation

CVE-2026-121424 is an address parsing vulnerability in Nodemailer's addressparser component that allows remote attackers to redirect email recipients or spoof senders by exploiting improper handling of nested RFC 5322 comments. The flaw affects Nodemailer versions 3.0.0 through 10.1.3 (fixed in 10.1.4). It was discovered during an internal review on 2026-10-18 and publicly disclosed on November 3, 2026. The vulnerability carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 8.3 (High) (GitHub Advisory, Github Advisory DB).

The root cause is improper input validation (CWE-20) combined with an interpretation conflict (CWE-436/CWE-115): addressparser terminates an RFC 5322 comment at the first closing parenthesis ) it encounters, rather than tracking comment nesting depth. RFC 5322 allows nested comments such as (x(y) ), where the outer comment closes only at the final ). Because addressparser exits the comment prematurely at the inner ), the remaining text — including an attacker-controlled email address — is parsed as header content and used as the actual recipient. A proof-of-concept is included in the advisory: addressparser("Victim (x(y) ) ") returns [{ address: 'evil@evil.com', name: 'Victim) v@victim.com' }] when the outer comment contains an attacker address, while conformant parsers (e.g., Python's email._header_value_parser) correctly read the same string as v@victim.com (GitHub Advisory). The fix tracks comment nesting depth and only closes a comment at the ) that matches the outermost opening parenthesis (GitHub Advisory).

Successful exploitation allows an unauthenticated attacker to redirect outbound email to an attacker-controlled address, bypassing recipient allow lists and domain restrictions enforced by conformant validators. In the inbound direction (via mailparser), the parsing discrepancy between Nodemailer and conformant parsers enables sender spoofing — a DMARC or display layer built on a conformant parser and a mail client built on mailparser will disagree on the message author, creating conditions for phishing. The primary impacts are high confidentiality loss (sensitive email content disclosed to the attacker) and low integrity loss (spoofed sender attribution), with no availability impact (GitHub Advisory, Github Advisory DB).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date (Github Advisory DB). The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable, reflecting the high attack complexity and the requirement for specific deployment conditions (the attacker must be able to influence an address passed to Nodemailer). The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No threat actor attribution has been reported (Feedly).

1. Identify a target application: Find a web application or service that uses Nodemailer (versions 3.0.0–10.1.3) to send email and accepts user-supplied email addresses (e.g., a registration form, contact form, or email forwarding service).
2. Understand the allow-list: Determine the domain(s) or addresses the application permits — for example, only addresses at victim.com.
3. Craft a malicious address: Construct an RFC 5322-compliant address that embeds the attacker's address inside a nested comment. Example: Victim (x(y) evil@attacker.com) v@victim.com — a conformant parser reads this as v@victim.com, but Nodemailer's addressparser exits the comment at the first ) and parses evil@attacker.com as the recipient.
4. Submit the crafted address: Submit the malicious address through the application's input field. The application's validator (using a conformant RFC 5322 parser) accepts it as v@victim.com, passing the allow-list check.
5. Email is redirected: Nodemailer delivers the email to evil@attacker.com instead of v@victim.com, disclosing the email content to the attacker.
6. Sender spoofing (inbound): Alternatively, send an inbound message with a crafted From header to a system using mailparser; the display layer and the mail client will disagree on the sender identity, enabling phishing or impersonation (GitHub Advisory).

• Logs: Application logs showing email delivery to unexpected external domains despite allow-list enforcement; SMTP server logs recording RCPT TO addresses that differ from the To: header value displayed to users.
• Network: Outbound SMTP connections to domains not in the application's approved recipient list; unexpected email delivery confirmations from external mail servers.
• Application Behavior: Discrepancy between the address validated by the application and the address recorded in the mail transfer agent's delivery log; user complaints about not receiving expected emails while an external party receives them instead.
• Email Headers: Inbound messages where the From address parsed by mailparser differs from the address parsed by other RFC 5322-compliant tools, indicating a crafted nested-comment address (GitHub Advisory).

The primary remediation is to upgrade Nodemailer to version 10.1.4 or later, which fixes the comment-depth tracking in addressparser (GitHub Advisory). As a defense-in-depth measure, implement email authentication protocols (DMARC, SPF, DKIM) to detect and prevent spoofed or redirected emails, and consider validating parsed addresses using multiple conformant parsers to detect discrepancies before passing them to Nodemailer. Applications that cannot upgrade immediately should restrict user-controlled input to simple address formats and reject addresses containing parentheses or comment syntax (Feedly).

The vulnerability was discovered during an internal review of addressparser on 2026-10-18 and reported by the Nodemailer maintainer (andris9), who published the advisory and patch simultaneously (GitHub Advisory). Red Hat tracked the issue via Bugzilla (bug #2565945) and published a CVE advisory, indicating downstream awareness among enterprise Linux distributions (Red Hat). Tenable added detection via Nessus plugin 375606 shortly after disclosure, reflecting prompt uptake by the vulnerability management community.