EM-20261103-VKUA VulnerabilityHigh severity

Nodemailer Vulnerability (CVE-2026-121424)

CVE-2026-121424

Status

Developing

Since Nov 03 15:17 UTC: signals keep joining.

First Signal: Nov 03 14:28 UTCC41 Red Hat Security Data
Page Born: Nov 03 15:17 UTCsecond source joined
Last Signal: Nov 03 15:17 UTC26 hours before snapshot
Sources: 21 official · 1 research, news or crowd
Open For: 24 hoursso far

Life Of This Page

1
Born

Nov 03 15:17 UTC
A second, independent source names it.
2
Developing · Now

Nov 03 15:17 UTC
New signals join; severity can move.
3
Confirmed

Not yet
CISA KEV lists it, or exploitation in the wild is reported.
4
Resolved

Not yet
Past the fix deadline and 14 days with no new signal.
5
Archived

Not yet
30 days after resolved. Read only; the link keeps working. Reopens if it comes back.

The address and ID never change. A correction is logged, never overwritten. If two pages turn out to be one incident, the later one points to the earlier.

Vulnerability Lifecycle

Disclosed: reached

Nov 03 15:17 UTC
C6 NVD published
Scored: reached

Nov 03 15:17 UTC
CVSS 8.3 · EPSS 0.3%
Exploited: not yet

Not yet
No exploitation reported
Advisories: not yet

Not yet
None yet
Vendor Response: reached

Nov 03 14:28 UTC
C41 published
Resolved: not yet

Not yet
After 14 quiet days

Timeline

Point at a mark to read it. Squares are signals, colored by severity; every one is also listed under Signals.

Signals

Nov 03 15:17 UTCCVE-2026-121424 (CVSS 8.3) (opens source in a new tab) Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect recipients by ending nested RFC 5322 comments at the first closing parenthesis. Atta… High severityDatabaseC6 NVD CVE API 2.0
Nov 03 14:28 UTCRed Hat: CVE-2026-121424 (moderate) (opens source in a new tab) nodemailer: nodemailer: Email redirection via nested comment parsing Med severityVendorC41 Red Hat Security Data