Is CVE-2026-110870 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-110870?

CVE-2026-110870 has a CVSS v3 severity of MEDIUM (5.3).

Back

CVE-2026-110870

Description

Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal characters reach envelope.to and RCPT TO, causing rejected delivery or parser interpretation conflicts that bypass domain allow-lists.