CVE-2026-121425: 
Grafana vulnerability analysis and mitigation

CVE-2026-121425 is a recipient injection vulnerability in Nodemailer's addressparser component, caused by a parsing flaw that incorrectly terminates RFC 5322 address groups at semicolons appearing inside quoted display names or comments. This allows attackers to craft syntactically valid group addresses that bypass recipient validation and redirect emails to attacker-controlled recipients. Affected versions span Nodemailer 3.0.0 through 10.1.3 (fixed in 10.1.4). The vulnerability carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 8.3 (High) (GitHub Advisory, Github Advisory DB).

The root cause is improper input validation (CWE-20) combined with an interpretation conflict (CWE-436/CWE-115): Nodemailer's addressparser ends an RFC 5322 group at the first semicolon it encounters, even when that semicolon appears inside a quoted string or comment — contexts where it should be treated as literal text. This causes text following the premature group termination to be re-parsed as top-level recipients. For example, the input G: (a; ) ; is parsed by conformant validators as a single mailbox v@victim.com, but Nodemailer delivers to evil@evil.com instead. The same bypass works via quoted display names: G: "a;" "" ;. The attacker only needs control over an address field passed to Nodemailer — no application credentials or configuration access is required (GitHub Advisory).

Successful exploitation causes emails intended for approved recipients to be silently redirected to attacker-chosen addresses, resulting in high confidentiality impact (disclosure of email content to unauthorized parties) and low integrity impact (the intended recipient never receives the message). Applications that enforce recipient allow lists based on a conformant RFC 5322 parser are particularly at risk, as the malicious address passes validation before being misinterpreted by Nodemailer. Both direct sendMail() callers and consumers of the standalone mailparser library are affected (GitHub Advisory, Github Advisory DB).

A proof-of-concept code snippet demonstrating the parsing flaw is publicly available in the Nodemailer security advisory, though it only calls the vulnerable library function locally and does not constitute a weaponized exploit (GitHub Advisory). There is no confirmed in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is 0.0, reflecting low current exploitation probability. NVD SSVC classifies exploitation status as "poc" and the attack as non-automatable due to the high attack complexity requirement (Github Advisory DB).

1. Identify a target application: Find a Node.js application that uses Nodemailer (versions 3.0.0–10.1.3) to send emails and enforces a recipient allow list validated by a conformant RFC 5322 parser.
2. Craft a malicious group address: Construct an address string that embeds a semicolon inside a comment or quoted display name, such as G: (a; ) ; or G: "a;" "" ;, where v@victim.com is an approved address and evil@evil.com is the attacker's address.
3. Submit the crafted address: Provide the malicious address string as the recipient field in any user-controlled input that the application passes to Nodemailer (e.g., a contact form, API endpoint, or email forwarding feature).
4. Bypass validation: The application's conformant RFC 5322 validator parses the input and sees only the approved address (e.g., v@victim.com), allowing the request to proceed.
5. Achieve email redirection: Nodemailer's addressparser prematurely ends the group at the embedded semicolon and re-parses the remaining text as a top-level recipient, delivering the email exclusively to the attacker-controlled address while the intended recipient receives nothing (GitHub Advisory).

• Logs: Application email logs showing outbound messages addressed to unexpected external domains despite recipient allow list enforcement; discrepancies between the To: header address and the actual SMTP RCPT TO envelope address.
• Network: SMTP traffic (port 25/587/465) delivering messages to recipients not matching the application's approved domain list; unexpected outbound email volume to external addresses.
• Application Behavior: User complaints about sent emails not being received by intended recipients; email delivery receipts or bounce messages referencing addresses not submitted by the user.
• Input Patterns: Presence of address strings containing semicolons inside parentheses or quoted strings in application logs or request payloads (e.g., patterns matching .*\(.*";".*\).* or ".*";.*") (GitHub Advisory).

Upgrade Nodemailer to version 10.1.4 or later, which fixes the addressparser to correctly track quoted strings and comments within groups and only terminates a group at semicolons appearing outside those contexts (GitHub Advisory). As a defense-in-depth measure, implement recipient validation at the application level independently of address parsing — enforce allow lists after Nodemailer resolves the final envelope recipients rather than relying solely on pre-send validation. Additionally, consider sanitizing or rejecting address inputs containing semicolons within quoted strings or comments before passing them to Nodemailer.

The vulnerability was discovered during an internal review of addressparser on 2026-10-18 and reported by the Nodemailer maintainer (andris9), who published the advisory and released the fix (GitHub Advisory). Red Hat tracked the issue via Bugzilla (Bug #2565869) and published a security advisory, indicating awareness among enterprise Linux distributors (Red Hat). Tenable added a Nessus detection plugin (ID 375575) shortly after disclosure. Community discussion was noted on Infosec.Exchange and aggregated by vulnerability tracking services including VulnDB and CVEFeed.