# Nodemailer addressparser angle-addr parsing bypass

Source: https://junglewise.ai/threats/nodemailer-a-inside-a-quoted-local-part-ends-an-angle-addr-early-in-28663cfb  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 6.5 · Published 2026-10-23

Nodemailer, a library used by applications to send emails, contains a flaw in how it parses recipient addresses. An attacker can craft a malformed but technically valid email address that bypasses validation checks, causing emails intended for an allowed domain to be delivered to an attacker-controlled domain instead. This allows theft of email content that should have been restricted to authorized recipients.

Technologies: [Nodemailer](https://junglewise.ai/threats/technologies/nodemailer), [nodemailer (npm)](https://junglewise.ai/threats/technologies/npm-nodemailer). Vendors: [Nodemailer](https://junglewise.ai/threats/vendors/nodemailer), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 6.5, published 23 October 2026.

**Which products and versions are affected?** Nodemailer 3.0.0 through 10.1.3; nodemailer (npm) >= 3.0.0, < 10.1.4, SEMVER:introduced=3.0.0,fixed=10.1.4.

**Is there a fix for This vulnerability?** Yes. nodemailer (npm): upgrade to 10.1.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network.

**Am I affected?** Check whether you run Nodemailer or nodemailer (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- nodemailer (npm): upgrade to 10.1.4 or later

  ```sh
  npm install nodemailer@10.1.4
  ```


## Technical details

The addressparser component incorrectly terminates angle-bracket address parsing at the first `>` character encountered, even when that character appears inside a quoted local part, comment, or domain literal. This causes addresses like `<"a@evil.com>"@good.com>` to be misparsed as `"a@evil.com` at domain `evil.com`, while RFC 5322 conformant parsers correctly read it as `"a@evil.com>"@good.com`. An attacker can exploit this by submitting such an address through user-input forms that validate against a conformant parser but then pass the address to Nodemailer, bypassing domain allowlists and causing mail to be delivered to attacker-controlled domains.

## Affected products

- Nodemailer Nodemailer 3.0.0 through 10.1.3

## Timeline

- 2026-10-23: disclosed
- 2026-10-18: other: vulnerability found in internal review

## Related threats

- [Nodemailer address parsing bypass in addressparser](https://junglewise.ai/threats/cve-2026-125755-nodemailer-3-0-0-before-10-4-1-contains-an-address-parsing-flaw)
- [Nodemailer address parsing bypass in nested RFC 5322 comments](https://junglewise.ai/threats/cve-2026-121424-nodemailer-from-3-0-0-before-10-1-4-contains-an-address-parsing)
- [Nodemailer addressparser RFC 5322 comment parsing bypass](https://junglewise.ai/threats/nodemailer-a-nested-comment-ends-early-in-addressparser-releasing-the-4e80613c)
- [Nodemailer addressparser group terminator bypass in quoted strings](https://junglewise.ai/threats/nodemailer-a-inside-a-quoted-string-or-comment-ends-an-address-group-b8b045f9)
- [Nodemailer quadratic DKIM header unfolding denial of service](https://junglewise.ai/threats/duplicate-advisory-nodemailer-quadratic-o-n-2-dkim-header-unfolding-a2b86ca5)