Nodemailer addressparser group terminator bypass in quoted strings

Severity: medium · CVSS 6.5 · Published 2026-10-23

Nodemailer, a popular Node.js email library, contains a flaw in how it parses email address groups that allows attackers to redirect mail to unintended recipients. An attacker who controls the email address field in an application can craft a malicious address that bypasses recipient validation, causing messages intended for an approved recipient to be sent to the attacker's address instead. This breaks the confidentiality of email content and defeats authorization controls in applications using the library.

Technologies: Nodemailer, nodemailer (npm). Vendors: Nodemailer, npm.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Medium severity, with a CVSS score of 6.5, published 23 October 2026.
Which products and versions are affected?
Nodemailer 3.0.0 through 10.1.3; nodemailer (npm) >= 3.0.0, < 10.1.4, SEMVER:introduced=3.0.0,fixed=10.1.4.
Is there a fix for This vulnerability?
Yes. nodemailer (npm): upgrade to 10.1.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network, in a software library.
Am I affected?
Check whether you run Nodemailer or nodemailer (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • nodemailer (npm): upgrade to 10.1.4 or later
    npm install nodemailer@10.1.4

Technical details

The addressparser component incorrectly terminates RFC 5322 address groups at the first semicolon, even when that semicolon appears inside a quoted string or comment. This causes the text after the semicolon to be re-parsed with inverted quoting semantics, turning display names or comments into live recipient addresses. An attacker can exploit this by submitting syntactically valid group addresses like `G: (a; <evil@evil.com>) <v@victim.com>;` that conformant parsers accept, but which Nodemailer misinterprets as directing mail to the attacker's address. The vulnerability requires the attacker to control an address field passed to Nodemailer or parsed from an inbound message header.

Affected products

  • Nodemailer Nodemailer 3.0.0 through 10.1.3

Timeline

  • 2026-10-18: disclosed: Found in internal review
  • 2026-10-23: advisory

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.