A flaw was found in nodemailer. The address parser incorrectly processes email addresses containing quoted local parts followed by comments, allowing trailing domain text to be retained in the normalized address. A remote attacker could supply a crafted recipient address to inject malformed domain data into the Simple Mail Transfer Protocol (SMTP) message envelope, potentially leading to unintended email routing or delivery.
Last checked: 2026-09-30 17:15 UTC
Proof of concept · CISA Coordinator (Assessed 2026-09-28 17:42 UTC)
Fix evidence last checked: 2026-09-29 10:30 UTC