Junglewise Threat Intelligence

Nodemailer interpretation conflict in email address parsing

Severity: high · CVSS 7.5 · Published 2025-11-14

Technologies: Nodemailer. Vendors: Nodemailer.

Executive brief

Nodemailer is a popular library used by Node.js applications to send emails. A vulnerability in how it handles recipient addresses allows an attacker to craft a special email address that tricks the system into sending messages to an unintended external domain. This can result in sensitive data being leaked to an attacker and may allow them to bypass security filters or access controls that rely on domain-based rules.

Technical details

A vulnerability exists in Nodemailer's address parser (specifically handling quoted local-parts) due to an interpretation conflict (CWE-436). When a recipient address contains an '@' symbol inside a quoted string (e.g., '"user@attacker.com"@internal.domain'), the parser may incorrectly prioritize the embedded address, routing the email to the attacker's domain instead of the RFC-compliant target domain. This allows for remote, unauthenticated data exfiltration or security filter evasion. The issue is fixed in version 7.0.7 by improving the handling of quoted nested email addresses to align with RFC 5321/5322.

Affected products

  • Nodemailer nodemailer < 7.0.7

Timeline

  • 2025-10-05: advisory: Original advisory GHSA-mm7p-fcc7-pg87 published
  • 2025-11-14: disclosed: CVE-2025-13033 published
  • 2025-11-17: patched: Version 7.0.7 released and duplicate advisory withdrawn

References

Related threats