Executive brief
Nodemailer is a popular Node.js library for sending emails. A vulnerability in its email address parsing logic allows attackers to craft specially formatted recipient addresses that cause emails to be sent to unintended external domains instead of the intended internal recipients. This could result in sensitive data being leaked to attackers or security controls being bypassed.
Technical details
The vulnerability stems from improper parsing of RFC 5321/5322 compliant email addresses, specifically in handling quoted local-parts containing @ symbols. An attacker can craft a recipient address such as "xclow3n@gmail.com x"@internal.domain, where the parser incorrectly extracts the embedded email address and misdirects the message to an external domain (xclow3n@gmail.com) rather than the intended internal recipient. The attack requires no authentication or user interaction; it operates at the network level through normal email sending functionality. This allows data exfiltration, anti-spam filter evasion, and domain-based access control bypass in downstream applications. The vulnerability affects all versions up to and including 7.0.6; a fix is available in version 7.0.7.
Affected products
- Nodemailer nodemailer <= 7.0.6
Timeline
- 2025-10-05: disclosed
- 2025-10-05: patched: Version 7.0.7 available
- 2025-11-14: advisory