CVE-2026-110870

Executive Summary

Nodemailer, a widely used Node.js library for sending email, contains an improper input validation vulnerability (CWE-20) in its address parser. The parser fails to strip RFC 5322 comments embedded within angle-bracket addresses, allowing attacker-controlled recipients with parenthesized comments in the domain to reach the envelope to field and RCPT TO SMTP command. This can cause rejected delivery or parser interpretation conflicts that bypass domain allow-lists, affecting applications using Nodemailer from version 3.0.0 before 10.0.13. With a CVSS score of 5.3 (Medium), the vulnerability primarily impacts integrity through unauthorized bypass of email domain restrictions.

Technical Analysis

The vulnerability resides in Nodemailer's address parser, which is responsible for processing email addresses supplied by applications. According to RFC 5322, comments can appear in various parts of an address, typically enclosed in parentheses. For example, user@(comment)domain.com is a technically valid address where (comment) is a comment that should be ignored for routing purposes. Nodemailer versions from 3.0.0 up to 10.0.13 fail to strip these comments when the address is enclosed in angle brackets (e.g., <user@(comment)domain.com>). As a result, the illegal characters (the parentheses and comment content) are passed through to the envelope to field, which is then used in the SMTP RCPT TO command.

This improper validation causes two primary issues:

1. Rejected delivery: SMTP servers may reject the malformed RCPT TO command, leading to delivery failures.
2. Parser interpretation conflicts: Different mail servers or security gateways may interpret the address differently. An attacker can craft an address that appears to belong to an allowed domain when parsed by a naive filter but is actually routed to a different domain when processed by the final mail server. This can bypass domain allow-lists that are intended to restrict outbound email to trusted domains.

The attack surface is any application that uses Nodemailer to send emails and relies on domain allow-lists for security, such as preventing data exfiltration or limiting spam. The vulnerability is network-exploitable (AV:N) with low attack complexity (AC:L) and requires no privileges (PR:N) or user interaction (UI:N). The impact is limited to integrity (I:L) as it can bypass intended restrictions but does not directly lead to confidentiality or availability loss (C:N/A:N).

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class and NVD description.

1. Reconnaissance/target identification: An attacker identifies a target application that uses a vulnerable version of Nodemailer (3.0.0 to 10.0.12) to send emails. This could be a web application that allows users to send emails to specified recipients, such as a contact form, invitation system, or password reset feature. The attacker also determines that the application enforces a domain allow-list, restricting recipients to certain trusted domains (e.g., @company.com).

2. Triggering the flaw: The attacker supplies a recipient address that includes a parenthesized comment within the angle-bracket address. For example: <attacker@evil.com(comment)trusted.com> or <user@(comment)trusted.com>. The exact syntax that triggers the bypass depends on how the application passes the address to Nodemailer. Typically, the attacker would input this address into a user-controllable field (e.g., "To" field in a form).

3. Payload/execution: The application passes the malicious address to Nodemailer's address parser. Due to the improper input validation, the parser fails to strip the comment, and the raw string (including the comment) is used in the envelope to field. When Nodemailer sends the email via SMTP, it issues a RCPT TO:<attacker@evil.com(comment)trusted.com> command. The attacker's goal is to have the email delivered to an address outside the allow-list (e.g., attacker@evil.com) while the allow-list check (which may parse the address differently) sees it as belonging to trusted.com.

4. Post-exploitation impact: Successful exploitation allows the attacker to bypass the domain allow-list, potentially sending emails to arbitrary external addresses. This could be used for spam, phishing, or data exfiltration (e.g., sending sensitive information to an attacker-controlled email). The integrity impact is low because the bypass is limited to the recipient domain restriction; the attacker cannot directly execute code or access data. However, in some contexts, this could lead to further attacks, such as social engineering.

Impact Assessment

The CVSS score of 5.3 (Medium) reflects the limited impact: integrity is low (I:L), while confidentiality and availability are not affected. The attack is network-based, requires no privileges or user interaction, and has low complexity. Affected systems are Node.js applications using Nodemailer versions 3.0.0 to 10.0.12 that rely on domain allow-lists for security. The blast radius includes any such application, potentially leading to email delivery failures (availability impact on the application's functionality) or bypass of email restrictions. Business impact may include reputational damage from spam or phishing emails sent from the organization's infrastructure, and potential data leakage if email is used to exfiltrate data. However, the lack of public exploits and the specific conditions required (use of allow-lists and attacker-controlled recipient input) reduce the overall risk.

Detection Guidance

Sigma Rule

title: Nodemailer Address Parser Comment Injection
id: 8f9a3b2c-1d4e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
description: Detects attempts to exploit CVE-2026-110870 by injecting parenthesized comments in email addresses processed by Nodemailer.
author: valtersit.com
date: 2026-06-01
logsource:
  category: application
  product: nodemailer
detection:
  selection:
    event: 'email.send'
    recipient|re: '.*\(.*\).*'
  condition: selection
falsepositives:
  - Legitimate email addresses containing parentheses in the display name, but these should not appear in the domain part.
level: medium
tags:
  - attack.t1190
  - cve.2026-110870

YARA Rule

rule CVE_2026_110870_Nodemailer_Comment_Injection
{
    meta:
        description = "Detects malicious email addresses with parenthesized comments in Nodemailer address parsing"
        author = "valtersit.com"
        date = "2026-06-01"
        reference = "CVE-2026-110870"
        severity = "medium"
    strings:
        $email_pattern = /<[^>]*@[^>]*\([^)]*\)[^>]*>/
    condition:
        $email_pattern
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"CVE-2026-110870 Nodemailer Address Parser Comment Injection Attempt"; flow:to_server,established; content:"RCPT TO"; nocase; content:"("; within:100; content:")"; within:100; reference:cve,2026-110870; classtype:attempted-recon; sid:10000001; rev:1;)

Elastic Detection

process where event.action == "email-send" and
  process.name == "node" and
  wildcard(recipient, "*@*(\\(*\\)*)*")

Splunk SPL Query

index=app_logs sourcetype=nodemailer
| search recipient="*@*\(*\)*"
| stats count by recipient, src_ip, user
| where count > 0

Wazuh OSSEC Rule

<group name="nodemailer,">
  <rule id="100001" level="10">
    <decoded_as>json</decoded_as>
    <field name="event">email.send</field>
    <field name="recipient">\.*\(.*\)\.*</field>
    <description>CVE-2026-110870: Nodemailer comment injection attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Validate and sanitize all user-supplied email addresses before passing them to Nodemailer. Specifically, reject or strip any addresses containing parentheses in the domain part, or enforce a strict regex that disallows comments.
   • Avoid relying solely on domain allow-lists implemented at the application level; instead, use a well-tested email validation library.
   • Upgrade to a version of Nodemailer that includes a fix (if available). As of this report, no patch is confirmed, so monitor the official Nodemailer repository for updates.

2. Patch/upgrade steps:

   • If a patched version (e.g., 10.0.13 or later) becomes available, upgrade immediately. Until then, consider using an alternative library or implementing a workaround.
   • For applications that cannot be updated, implement a custom address parser that correctly handles RFC 5322 comments, or pre-process addresses to remove comments.

3. Long-term hardening:

   • Follow secure coding practices: always validate and sanitize input, especially when it is used in security-sensitive contexts like email routing.
   • Regularly update dependencies and subscribe to security advisories for Nodemailer and other critical libraries.
   • Implement defense-in-depth: combine allow-lists with content filtering and monitoring for anomalous email sending behavior.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-110870
2. Nodemailer GitHub Repository: https://github.com/nodemailer/nodemailer
3. Nodemailer Security Advisories: https://github.com/nodemailer/nodemailer/security/advisories
4. RFC 5322 (Internet Message Format): https://tools.ietf.org/html/rfc5322
5. CWE-20: Improper Input Validation: https://cwe.mitre.org/data/definitions/20.html

No known threat actor campaigns or exploit-in-the-wild evidence have been observed for this CVE.