Description

Nodemailer is a Node.js email-sending library. In versions >= 9.1.0 and < 10.0.9, the address parser (src/addressparser) mishandles addresses whose local-part is a quoted string and that are followed by RFC 5322 comments, allowing trailing comment-separated domain atoms to be retained in the normalized address. For example, the input "user"@example.com(x)evil.com is parsed to the address value 'user@example.com evil.com', which contains additional attacker-controlled domain text separated by a literal space. This parsed value is used without further strict recipient validation when the message envelope is built (envelope.to in src/mime-node), so a malformed/ambiguous recipient address can be accepted and placed in the SMTP envelope. Whether this results in delivery to an unintended recipient on real SMTP servers has not been confirmed. The issue is a variant of the RFC 5322 comment parsing problem addressed in GHSA-cc9r-2j5m-2m83, affecting the separate quoted-local-part code path. Version 10.0.9 contains a fix.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-26T14:16:54.867Z",
  "pubdate": "2026-09-26T14:16:54.867Z",
  "executiveSummary": "Nodemailer is susceptible to an address parsing vulnerability in versions >= 9.1.0 and < 10.0.9, characterized by an improper handling of RFC 5322 comments within quoted local-part strings.\nThis vulnerability is categorized as an input validation flaw, where the parser fails to correctly terminate domain extraction when encountering specific comment structures following a quoted string.\nThe primary impact involves the generation of ambiguous or malformed SMTP recipient addresses that may bypass intended recipient validation logic.\nAn attacker can exploit this by crafting a specially formatted email address containing trailing domain atoms, which are subsequently integrated into the SMTP envelope by src/mime-node.\nWhile the downstream effect on specific SMTP server routing behavior remains unconfirmed, the capability to influence the envelope.to field poses a significant risk to mail delivery integrity and potential security policy bypasses.\nNo authentication or elevated privileges are required for an attacker to influence the input, provided they can control the recipient address submitted to the library.",
  "technicalDetails": "The vulnerability resides in the src/addressparser module of the Nodemailer library. The parser logic fails to enforce strict boundaries when processing email addresses where the local-part is a quoted string followed by RFC 5322 comments.\nThe root cause is an implementation flaw in the tokenization and normalization process, specifically regarding how trailing comment-separated domain atoms are handled. When the parser encounters an input like 'user'@example.com(x)evil.com, it incorrectly retains the portion following the comment as part of the normalized address value, resulting in 'user@example.com evil.com'.\nThis occurs because the parser logic incorrectly continues to process characters after the comment block, treating the trailing domain atoms as part of the validated recipient rather than discarding them as comments or flagging the address as invalid.\nThe exploitation flow proceeds as follows: First, an attacker supplies a malicious string to the application using Nodemailer. Second, the src/addressparser component parses the input, producing a concatenated and malformed string containing the intended address and the injected domain content. Third, this parsed output is passed to the src/mime-node module without additional sanitization or strict validation. Fourth, the library constructs the SMTP envelope using the corrupted address string in the envelope.to field.\nBecause the final envelope construction does not re-validate the parsed output, the SMTP transaction transmitted to the mail server includes the attacker-controlled text. The vulnerability is functionally similar to previously identified issues with RFC 5322 comment parsing (GHSA-cc9r-2j5m-2m83), indicating a failure to adequately secure the quoted-local-part code path against comment injection vectors.\nThe exposure is limited to systems utilizing Nodemailer >= 9.1.0 and < 10.0.9. Post-exploitation, the impact depends on the behavior of the destination SMTP server and its interpretation of malformed envelope recipients. Potential impacts include the redirection of mail, the bypassing of recipient-based filtering rules, or the inadvertent transmission of messages to unintended mail relays or domains."
}