# NextAuth.js email misdelivery via nodemailer address parser bug

Source: https://junglewise.ai/threats/nextauth-js-email-misdelivery-via-nodemailer-address-parser-bug-6824743e  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-10-29. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 4 · Published 2025-10-29

NextAuth.js is an authentication framework for web applications that supports email-based sign-in. A parsing bug in its email handling library (nodemailer) allows attackers to craft malicious email addresses that redirect login and verification emails to attacker-controlled mailboxes instead of the intended recipients. An attacker can exploit this to intercept sensitive authentication tokens and account verification links meant for legitimate users.

Technologies: [next-auth (npm)](https://junglewise.ai/threats/technologies/next-auth). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 4, published 29 October 2025.

**Which products and versions are affected?** next-auth (npm) SEMVER:introduced=0,fixed=4.24.12.

**Is there a fix for This vulnerability?** Yes. next-auth (npm): upgrade to 4.24.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run next-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- next-auth (npm): upgrade to 4.24.12 or later

  ```sh
  npm install next-auth@4.24.12
  ```


## Technical details

The vulnerability is rooted in nodemailer's RFC 5321/5322 non-compliant email address parser. When processing email sign-in requests, NextAuth.js passes user-supplied email addresses to nodemailer for sending authentication emails. A crafted input such as "e@attacker.com"@victim.com is misparsed, resulting in the message being delivered to e@attacker.com (attacker-controlled) instead of the intended recipient at victim.com. This occurs because the parser incorrectly handles quoted strings in email addresses. No authentication is required; the vulnerability is exploitable by submitting a malicious email address via the sign-in form. An attacker can receive login links, password reset tokens, or email verification codes intended for a victim. The vulnerability is patched in NextAuth.js versions 4.24.12 and 5.0.0-beta.30 by updating to nodemailer 7.0.7 or later.

## Affected products

- NextAuthjs next-auth <4.24.12, <5.0.0-beta.30

## Timeline

- 2025-10-29: disclosed: Advisory GHSA-5jpx-9hw9-2fx4 published
- 2025-10-27: patched: Patches released in next-auth 4.24.12 and 5.0.0-beta.30

## References

- [https://github.com/nextauthjs/next-auth/security/advisories/GHSA-5jpx-9hw9-2fx4](https://github.com/nextauthjs/next-auth/security/advisories/GHSA-5jpx-9hw9-2fx4)
- [https://github.com/nextauthjs/next-auth/commit/82efcf81f218aae43683f8dd2f7c260ef69b3ece](https://github.com/nextauthjs/next-auth/commit/82efcf81f218aae43683f8dd2f7c260ef69b3ece)
- [https://github.com/nextauthjs/next-auth/commit/8f3b2c7af0fe08973a12f616517c3ec85a5cd172](https://github.com/nextauthjs/next-auth/commit/8f3b2c7af0fe08973a12f616517c3ec85a5cd172)
- [https://github.com/nextauthjs/next-auth](https://github.com/nextauthjs/next-auth)

## Related threats

- [Auth.js authentication check bypass on configuration error](https://junglewise.ai/threats/cve-2026-73421-auth-js-authentication-check-bypass-on-configuration-error)
- [Auth.js email normalizer homoglyph @ bypass in passwordless sign-in](https://junglewise.ai/threats/cve-2026-73420-auth-js-email-normalizer-homoglyph-bypass-in-passwordless-sign-in)
- [Auth.js OAuth provider-confusion in state/nonce/PKCE cookies](https://junglewise.ai/threats/cve-2026-73419-auth-js-oauth-provider-confusion-in-state-nonce-pkce-cookies)
- [NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken()](https://junglewise.ai/threats/cve-2026-73418-auth-js-gettoken-exception-on-malformed-bearer-headers)
- [NextAuth.js authentication bypass via mock user creation](https://junglewise.ai/threats/cve-2023-48309-nextauth-js-authentication-bypass-via-mock-user-creation)