https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 14:51:58 +0000 https://cve.radiocsirt.org/vuln/ghsa-cc9r-2j5m-2m83 <p><strong>Affected:</strong> npm: nodemailer</p> <p>### Summary</p> <p>Nodemailer&#39;s email-address parser treats an **RFC 5322 comment** `( ... )` inside the domain as a point to **concatenate** the surrounding text, rather than as folding whitespace (CFWS) that **terminates** the domain. Consequently a recipient address such as `user@good-corp.com(x)evil.com` is parsed and **delivered to `good-corp.comevil.com`** (registrable domain `comevil.com`, attacker‑controlled), while a conformant RFC 5322 parser terminates the domain at the comment and reads `good-corp.com`.</p> <p>An application that decides *whether it is allowed to email a recipient* by parsing/validating the recipient&#39;s domain — with a strict RFC 5322 parser (used without inspecting parse defects) or with a naive prefix/substring allow‑list — and then hands the raw address to Nodemailer for delivery, can be induced to send mail to a domain the attacker controls. This is an **Interpretation Conflict (CWE‑436)**, the same class as CVE‑2025‑13033, reached through the RFC 5322 *comment* construct (the &#34;Comments&#34; technique in PortSwigger&#39;s *Splitting the email atom* research, which produced a Postfix fix).</p> <p>Severity is **Moderate**: exploitation requires the app&#39;s domain check to disagree with Nodemailer (see **Impact** for exactly which parsers do and do not). Verified end‑to‑end against a real RFC 5321 SMTP server (nodemailer 9.0.6 → `aiosmtpd`).</p> <p>### Details</p> <p>Root cause is in `lib/addressparser/index.js`.</p> <p>1. The tokenizer registers the comment as an operator pair (`Tokenizer.o…</p> <p><strong>Affected:</strong> npm: nodemailer</p> <p>### Summary</p> <p>Nodemailer&#39;s email-address parser treats an **RFC 5322 comment** `( ... )` inside the domain as a point to **concatenate** the surrounding text, rather than as folding whitespace (CFWS) that **terminates** the domain. Consequently a recipient address such as `user@good-corp.com(x)evil.com` is parsed and **delivered to `good-corp.comevil.com`** (registrable domain `comevil.com`, attacker‑controlled), while a conformant RFC 5322 parser terminates the domain at the comment and reads `good-corp.com`.</p> <p>An application that decides *whether it is allowed to email a recipient* by parsing/validating the recipient&#39;s domain — with a strict RFC 5322 parser (used without inspecting parse defects) or with a naive prefix/substring allow‑list — and then hands the raw address to Nodemailer for delivery, can be induced to send mail to a domain the attacker controls. This is an **Interpretation Conflict (CWE‑436)**, the same class as CVE‑2025‑13033, reached through the RFC 5322 *comment* construct (the &#34;Comments&#34; technique in PortSwigger&#39;s *Splitting the email atom* research, which produced a Postfix fix).</p> <p>Severity is **Moderate**: exploitation requires the app&#39;s domain check to disagree with Nodemailer (see **Impact** for exactly which parsers do and do not). Verified end‑to‑end against a real RFC 5321 SMTP server (nodemailer 9.0.6 → `aiosmtpd`).</p> <p>### Details</p> <p>Root cause is in `lib/addressparser/index.js`.</p> <p>1. The tokenizer registers the comment as an operator pair (`Tokenizer.o…</p> https://cve.radiocsirt.org/vuln/ghsa-cc9r-2j5m-2m83