# CVE-2026-125756: postal-mime address parser domain truncation

Source: https://junglewise.ai/threats/cve-2026-125756-postal-mime-before-4-2-1-contains-a-parser-differential  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-125756 · Severity: medium · CVSS 5.9 · Published 2026-11-10

postal-mime is a JavaScript library for parsing email messages. An attacker can craft email addresses where the parser truncates the domain at whitespace or comments, causing it to report a spoofed sender address while the email passes authentication checks (SPF/DKIM/DMARC) for the attacker's actual domain. This could enable email spoofing attacks where users see a trusted sender address.

Technologies: [Postalsys Postal-Mime](https://junglewise.ai/threats/technologies/postalsys-postal-mime). Vendors: [Postalsys](https://junglewise.ai/threats/vendors/postalsys).

## Quick answers

**Is CVE-2026-125756 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-125756 being exploited in the wild.

**How severe is CVE-2026-125756?** Medium severity, with a CVSS score of 5.9, published 10 November 2026.

**Which products and versions are affected?** Postalsys Postal-Mime before 4.2.1.

**Is there a fix for CVE-2026-125756?** Yes: fixed in postal-mime 4.2.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-125756 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-125756?** Check whether you run Postalsys Postal-Mime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in postal-mime 4.2.1

## Technical details

The address parser incorrectly handles RFC 5322 obsolete syntax (CFWS—comments and folding whitespace) around domain dots, truncating the domain prematurely. An attacker can craft addresses like "ceo@victim.example .evil.example" which the parser reads as "ceo@victim.example" (reporting victim as the sender) while passing SPF/DKIM/DMARC alignment checks against the attacker's subdomain. The vulnerability affects parsing of From headers with attacker-controlled input; a network attacker or email sender can exploit this.

## Affected products

- PostalSys postal-mime before 4.2.1

## Timeline

- 2026-11-10: disclosed

## References

- [https://github.com/postalsys/postal-mime/blob/939a220bd518f54d98a088c315d7227e6215cae3/src/address-parser.ts](https://github.com/postalsys/postal-mime/blob/939a220bd518f54d98a088c315d7227e6215cae3/src/address-parser.ts)
- [https://github.com/postalsys/postal-mime/commit/646725704463839f233472453b7c8306bd1dde21](https://github.com/postalsys/postal-mime/commit/646725704463839f233472453b7c8306bd1dde21)

## Related threats

- [postal-mime algorithmic complexity denial of service](https://junglewise.ai/threats/cve-2026-124016-postal-mime-before-4-2-1-contains-an-algorithmic-complexity)
- [postal-mime quadratic CPU consumption in RFC 2047 header decoding](https://junglewise.ai/threats/postal-mime-quadratic-cpu-consumption-when-decoding-a-header-of-many-196c0d88)