Executive brief
Nodemailer's email address parser incorrectly handles RFC 5322 comment syntax, allowing attackers to craft recipient addresses that pass domain validation checks but are delivered to attacker-controlled domains. An application using a standards-compliant email parser to validate recipients before passing them to Nodemailer can be tricked into sending messages to the wrong domain, potentially exposing sensitive communications or bypassing access controls.
Technical details
The vulnerability is an interpretation conflict (CWE-436) in the address parser (`lib/addressparser/index.js`). When a closing parenthesis `)` of an RFC 5322 comment is immediately followed by a non-whitespace character, the tokenizer marks the token with `noBreak=true`. The `_handleAddress` function then concatenates the following token directly to the preceding token, skipping the comment entirely. For example, `user@good-corp.com(x)evil.com` is tokenized and then reconstructed as `user@good-corp.comevil.com`, delivering to domain `comevil.com` instead of `good-corp.com`. RFC 5322 specifies that comments are folding whitespace that terminates the domain atom. The attack succeeds when an application validates the recipient domain using a standards-compliant parser (or naive prefix/substring checks) that correctly reads `good-corp.com`, but then passes the raw address to Nodemailer, which delivers to the concatenated `comevil.com` domain. The parsed address is used for both the SMTP envelope and email headers, so the entire message is misrouted. Fixed in version 9.1.0 by preventing `noBreak` propagation across comment-closing parentheses.
Affected products
- nodemailer nodemailer >=6.9.16, <9.1.0
Timeline
- 2026-09-01: disclosed
- 2026-09-01: patched: Fixed in version 9.1.0 (commit 902b63e)