CVE-2026-3455: mailparser Vulnerable to Cross-site Scripting (XSS)
Summary
CVE-2026-3455: mailparser vulnerable to Cross-site Scripting. Affects mailparser versions < 3.9.3. Fixed in 3.9.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mailparser is an npm package designed for parsing email content, allowing developers to extract and manipulate email data easily. It is widely used in applications that require email handling functionalities. However, certain versions of mailparser prior to 3.9.3 are susceptible to a Cross-site Scripting (XSS) vulnerability, which can compromise user security.
Vulnerability Detail
The vulnerability arises from the textToHtml() function in mailparser, which fails to properly sanitize URLs within the email content. This oversight allows attackers to inject malicious JavaScript code into URLs by adding extra quotes. When unsuspecting users click on these links, the scripts can execute in their browsers, leading to potential data theft or session hijacking.
How To Fix
Latest published version: 3.12.4 as of 23 Oct 2026
npm install mailparser@3.12.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.9.3
This is the first release that contains the fix.
npm install mailparser@3.9.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement additional sanitization on URLs before they are processed by the textToHtml() function. This can help mitigate the risk of XSS attacks until you can update the package. For example, you can use a library like DOMPurify to sanitize the URLs.
Conclusion
The mailparser package has a critical vulnerability (CVE-2026-3455) that exposes users to Cross-site Scripting attacks due to improper URL sanitization. It is essential to update to version 3.9.3 or later to mitigate this risk. Additionally, consider using Vulert for ongoing monitoring of your dependencies.
See every vulnerability recorded for mailparser →
FAQ
XSS is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, potentially compromising their data and security.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your package-lock.json for vulnerabilities without requiring signup.
If exploited, this vulnerability can allow attackers to execute arbitrary scripts in victim browsers, leading to data theft, session hijacking, and other malicious activities.
Yes, Vulert provides real-time monitoring and alerts for open-source vulnerabilities using just your package-lock.json file.
If an immediate update is not possible, implement URL sanitization as a temporary measure to reduce the risk of XSS attacks.
