This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-125755 →
Unrated
Nodemailer 3.0.0 before 10.4.1 contains an address parsing flaw in addressparser that truncates domains at folding whitespace or comments before a dot...
UBUNTU-CVE-2026-125755
First seen on SecPulse
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| Ubuntu:20.04:LTSnode-nodemailer |
All versions→ Not listed |
Not listed |
| Ubuntu:22.04:LTSnode-nodemailer |
All versions→ Not listed |
Not listed |
| Ubuntu:24.04:LTSnode-nodemailer |
All versions→ Not listed |
Not listed |
| Ubuntu:26.10node-nodemailer |
All versions→ Not listed |
Not listed |
| Ubuntu:26.04:LTSnode-nodemailer |
All versions→ Not listed |
Not listed |
This record does not list fixed versions. Check the article or the vendor advisory in the references for whether and where it is fixed.
Original description The description as published by the source.
Nodemailer 3.0.0 before 10.4.1 contains an address parsing flaw in addressparser that truncates domains at folding whitespace or comments before a dot, allowing attackers to bypass recipient domain restrictions. Attackers can submit crafted to, cc, bcc or replyTo addresses that pass RFC 5322 domain checks but deliver mail to an attacker-chosen address under the application's sender identity.
Source: OSV.dev (Open Source Vulnerabilities) OSV
References
- report ubuntu.com
- report cve.org
- report github.com
- report github.com
- report github.com
- report github.com
- report vulncheck.com