https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 20 Oct 2026 11:00:15 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-110870 <p>Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal characters reach envelope.to and RCPT TO, causing rejected delivery or parser interpretation conflicts that bypass domain allow-lists.</p> <p>Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal characters reach envelope.to and RCPT TO, causing rejected delivery or parser interpretation conflicts that bypass domain allow-lists.</p> https://db.gcve.eu/vuln/fkie_cve-2026-110870 https://db.gcve.eu/vuln/ghsa-597p-2mmq-hhg9 <p>Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal characters reach envelope.to and RCPT TO, causing rejected delivery or parser interpretation conflicts that bypass domain allow-lists.</p> <p>Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal characters reach envelope.to and RCPT TO, causing rejected delivery or parser interpretation conflicts that bypass domain allow-lists.</p> https://db.gcve.eu/vuln/ghsa-597p-2mmq-hhg9 https://db.gcve.eu/vuln/ubuntu-cve-2026-110870 <p><strong>Affected:</strong> Ubuntu:20.04:LTS: node-nodemailer, Ubuntu:22.04:LTS: node-nodemailer, Ubuntu:24.04:LTS: node-nodemailer, Ubuntu:26.10: node-nodemailer, Ubuntu:26.04:LTS: node-nodemailer</p> <p>Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal characters reach envelope.to and RCPT TO, causing rejected delivery or parser interpretation conflicts that bypass domain allow-lists.</p> <p><strong>Affected:</strong> Ubuntu:20.04:LTS: node-nodemailer, Ubuntu:22.04:LTS: node-nodemailer, Ubuntu:24.04:LTS: node-nodemailer, Ubuntu:26.10: node-nodemailer, Ubuntu:26.04:LTS: node-nodemailer</p> <p>Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal characters reach envelope.to and RCPT TO, causing rejected delivery or parser interpretation conflicts that bypass domain allow-lists.</p> https://db.gcve.eu/vuln/ubuntu-cve-2026-110870