Bug 2565869 (CVE-2026-121425)

A flaw was found in Nodemailer. This vulnerability allows a remote attacker to cause information disclosure by redirecting outgoing messages to attacker-chosen recipients and bypassing recipient allowlists. The issue occurs because the address parser prematurely terminates email address groups when encountering semicolons inside quoted display names or comments, causing display text to be interpreted as an active recipient address. An attacker who can influence email recipient fields can exploit this flaw by submitting crafted address strings that pass standard validation checks but deliver sensitive emails to unauthorized recipients.