{"id":"CVE-2026-100699","aliases":["CLSA-2026-1790854662","CLSA-2026-1793790274","CLSA-2026-1793801901","CLSA-2026-1793808867","CLSA-2026-1793814042","CLSA-2026-1793828946","CLSA-2026-1793874971","CLSA-2026-1793882612","DEBIAN-CVE-2026-100699","EUVD-2026-87672","GHSA-fcjc-3m4q-q926","GHSA-g57g-f23g-4646","GHSA-prgh-xp8r-p3m5","UBUNTU-CVE-2026-100699"],"status":"published","title":"Nodemailer before 10.0.9 Malformed Envelope Recipient via RFC 5322 Comment","description":"Nodemailer is a Node.js email-sending library. In versions \u003e= 9.1.0 and \u003c 10.0.9, the address parser (src/addressparser) mishandles addresses whose local-part is a quoted string and that are followed by RFC 5322 comments, allowing trailing comment-separated domain atoms to be retained in the normalized address. For example, the input \"user\"@example.com(x)evil.com is parsed to the address value 'user@example.com evil.com', which contains additional attacker-controlled domain text separated by a literal space. This parsed value is used without further strict recipient validation when the message envelope is built (envelope.to in src/mime-node), so a malformed/ambiguous recipient address can be accepted and placed in the SMTP envelope. Whether this results in delivery to an unintended recipient on real SMTP servers has not been confirmed. The issue is a variant of the RFC 5322 comment parsing problem addressed in GHSA-cc9r-2j5m-2m83, affecting the separate quoted-local-part code path. Version 10.0.9 contains a fix.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00233,"percentile":0.14365,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-436"],"published":"2026-09-26T13:23:55Z","modified":"2026-11-06T13:15:17Z","fixes":[{"ecosystem":"npm","package":"nodemailer","fixed_in":["10.0.9"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"nodemailer","fixed_in":["9.0.6-tuxcare.8","9.0.5-tuxcare.9","9.0.3-tuxcare.8","9.0.2-tuxcare.9","9.0.1-tuxcare.7","9.0.0-tuxcare.10","6.10.1-tuxcare.18"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-nodemailer","fixed_in":["10.0.10+~8.0.1-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.1.0"},{"fixed":"10.0.9"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.1.0-tuxcare.0"},{"fixed":"9.1.0-tuxcare.4"}]}],"versions":["9.1.0","9.1.0-tuxcare.1","9.1.0-tuxcare.2","9.1.0-tuxcare.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.6-tuxcare.0"},{"fixed":"9.0.6-tuxcare.8"}]}],"versions":["9.0.6","9.0.6-tuxcare.1","9.0.6-tuxcare.2","9.0.6-tuxcare.3","9.0.6-tuxcare.4","9.0.6-tuxcare.5","9.0.6-tuxcare.6","9.0.6-tuxcare.7"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.5-tuxcare.0"},{"fixed":"9.0.5-tuxcare.9"}]}],"versions":["9.0.5","9.0.5-tuxcare.1","9.0.5-tuxcare.2","9.0.5-tuxcare.3","9.0.5-tuxcare.4","9.0.5-tuxcare.5","9.0.5-tuxcare.6","9.0.5-tuxcare.7","9.0.5-tuxcare.8"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.3-tuxcare.0"},{"fixed":"9.0.3-tuxcare.8"}]}],"versions":["9.0.3","9.0.3-tuxcare.1","9.0.3-tuxcare.2","9.0.3-tuxcare.3","9.0.3-tuxcare.4","9.0.3-tuxcare.5","9.0.3-tuxcare.6","9.0.3-tuxcare.7"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.2-tuxcare.0"},{"fixed":"9.0.2-tuxcare.9"}]}],"versions":["9.0.2","9.0.2-tuxcare.1","9.0.2-tuxcare.2","9.0.2-tuxcare.3","9.0.2-tuxcare.4","9.0.2-tuxcare.5","9.0.2-tuxcare.6","9.0.2-tuxcare.7","9.0.2-tuxcare.8"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.1-tuxcare.0"},{"fixed":"9.0.1-tuxcare.7"}]}],"versions":["9.0.1","9.0.1-tuxcare.1","9.0.1-tuxcare.2","9.0.1-tuxcare.3","9.0.1-tuxcare.4","9.0.1-tuxcare.5","9.0.1-tuxcare.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-tuxcare.0"},{"fixed":"9.0.0-tuxcare.10"}]}],"versions":["9.0.0","9.0.0-tuxcare.1","9.0.0-tuxcare.2","9.0.0-tuxcare.3","9.0.0-tuxcare.4","9.0.0-tuxcare.5","9.0.0-tuxcare.6","9.0.0-tuxcare.7","9.0.0-tuxcare.8","9.0.0-tuxcare.9"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.10.1-tuxcare.0"},{"fixed":"6.10.1-tuxcare.18"}]}],"versions":["6.10.1","6.10.1-tuxcare.1","6.10.1-tuxcare.10","6.10.1-tuxcare.11","6.10.1-tuxcare.12","6.10.1-tuxcare.13","6.10.1-tuxcare.14","6.10.1-tuxcare.15","6.10.1-tuxcare.16","6.10.1-tuxcare.17","6.10.1-tuxcare.2","6.10.1-tuxcare.3","6.10.1-tuxcare.4","6.10.1-tuxcare.5","6.10.1-tuxcare.6","6.10.1-tuxcare.7","6.10.1-tuxcare.8","6.10.1-tuxcare.9"]},{"source":"osv","ecosystem":"Debian:12","package":"node-nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.0.0+~8.0.1-1","10.0.10+~8.0.1-1","10.0.10+~8.0.2-1","6.10.0+~6.4.17-1","6.8.0+~6.4.6-1","6.9.13+~6.4.14-1","6.9.15+~6.4.16-1","6.9.16+~6.4.16-1","6.9.4+~6.4.9-1","6.9.4+~6.4.9-2","6.9.4+~6.4.9-3","6.9.4+~6.4.9-4","7.0.10+~7.0.2-1","7.0.12+~7.0.5-1","7.0.5+~7.0.1-1","7.0.6+~7.0.1-1","7.0.9+~7.0.2-1","7.0.9+~7.0.2-2","8.0.11+~8.0.1-1","8.0.2+~7.0.11-1","8.0.3+~7.0.11-1","8.0.4+~7.0.11-1","8.0.4+~7.0.11-2","9.0.0+~8.0.1-1","9.0.3+~8.0.1-1","9.0.5+~8.0.1-1","9.0.6+~8.0.1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.0.0+~8.0.1-1","10.0.10+~8.0.1-1","10.0.10+~8.0.2-1","6.10.0+~6.4.17-1","6.10.0+~6.4.17-1+deb13u1","7.0.10+~7.0.2-1","7.0.12+~7.0.5-1","7.0.5+~7.0.1-1","7.0.6+~7.0.1-1","7.0.9+~7.0.2-1","7.0.9+~7.0.2-2","8.0.11+~8.0.1-1","8.0.2+~7.0.11-1","8.0.3+~7.0.11-1","8.0.4+~7.0.11-1","8.0.4+~7.0.11-2","9.0.0+~8.0.1-1","9.0.3+~8.0.1-1","9.0.5+~8.0.1-1","9.0.6+~8.0.1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.10+~8.0.1-1"}]}],"versions":["10.0.0+~8.0.1-1","6.10.0+~6.4.17-1","7.0.10+~7.0.2-1","7.0.12+~7.0.5-1","7.0.5+~7.0.1-1","7.0.6+~7.0.1-1","7.0.9+~7.0.2-1","7.0.9+~7.0.2-2","8.0.11+~8.0.1-1","8.0.2+~7.0.11-1","8.0.3+~7.0.11-1","8.0.4+~7.0.11-1","8.0.4+~7.0.11-2","9.0.0+~8.0.1-1","9.0.3+~8.0.1-1","9.0.5+~8.0.1-1","9.0.6+~8.0.1-1"]},{"source":"osv","ecosystem":"npm","package":"nodemailer","ranges":[{"type":"SEMVER","events":[{"introduced":"9.1.0"},{"fixed":"10.0.9"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.3.0-2","6.3.1-1","6.4.0-1","6.4.1-1","6.4.2-1","6.4.5-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.4.17-3","6.7.0-1","6.7.0-2","6.7.1+~6.4.4-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.9.4+~6.4.9-2","6.9.4+~6.4.9-3ubuntu1","6.9.4+~6.4.9-4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.0.4+~7.0.11-1","8.0.4+~7.0.11-2","9.0.0+~8.0.1-1","9.0.3+~8.0.1-1","9.0.5+~8.0.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.5+~7.0.1-1","7.0.9+~7.0.2-2","7.0.10+~7.0.2-1","7.0.12+~7.0.5-1","8.0.4+~7.0.11-1"]}],"products":[{"vendor":"nodemailer","product":"nodemailer"}],"references":[{"url":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-g57g-f23g-4646","tags":["vendor-advisory","exploit","advisory","web","report"]},{"url":"https://www.vulncheck.com/advisories/nodemailer-before-10.0.9-malformed-envelope-recipient-via-rfc-5322-comment","tags":["third-party-advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100699","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-fcjc-3m4q-q926"},{"url":"https://github.com/nodemailer/nodemailer/commit/2f36eb1aa1dd33e312411dc9b888548e14db54ee","tags":["web"]},{"url":"https://github.com/nodemailer/nodemailer/releases/tag/v10.0.9","tags":["web"]},{"url":"https://github.com/advisories/GHSA-g57g-f23g-4646"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100699.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-100699","tags":["advisory"]},{"url":"https://github.com/nodemailer/nodemailer","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-100699","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-100699","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-100699","title":"Nodemailer before 10.0.9 Malformed Envelope Recipient via RFC 5322 Comment","description":"Nodemailer is a Node.js email-sending library. In versions \u003e= 9.1.0 and \u003c 10.0.9, the address parser (src/addressparser) mishandles addresses whose local-part is a quoted string and that are followed by RFC 5322 comments, allowing trailing comment-separated domain atoms to be retained in the normalized address. For example, the input \"user\"@example.com(x)evil.com is parsed to the address value 'user@example.com evil.com', which contains additional attacker-controlled domain text separated by a literal space. This parsed value is used without further strict recipient validation when the message envelope is built (envelope.to in src/mime-node), so a malformed/ambiguous recipient address can be accepted and placed in the SMTP envelope. Whether this results in delivery to an unintended recipient on real SMTP servers has not been confirmed. The issue is a variant of the RFC 5322 comment parsing problem addressed in GHSA-cc9r-2j5m-2m83, affecting the separate quoted-local-part code path. Version 10.0.9 contains a fix.","status":"published","published":"2026-09-26T13:23:55.786Z","modified":"2026-09-28T17:43:19.483Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:20:06.562031Z"}],"euvd":[{"id":"EUVD-2026-87672","description":"Nodemailer is a Node.js email-sending library. In versions \u003e= 9.1.0 and \u003c 10.0.9, the address parser (src/addressparser) mishandles addresses whose local-part is a quoted string and that are followed by RFC 5322 comments, allowing trailing comment-separated domain atoms to be retained in the normalized address. For example, the input \"user\"@example.com(x)evil.com is parsed to the address value 'user@example.com evil.com', which contains additional attacker-controlled domain text separated by a literal space. This parsed value is used without further strict recipient validation when the message envelope is built (envelope.to in src/mime-node), so a malformed/ambiguous recipient address can be accepted and placed in the SMTP envelope. Whether this results in delivery to an unintended recipient on real SMTP servers has not been confirmed. The issue is a variant of the RFC 5322 comment parsing problem addressed in GHSA-cc9r-2j5m-2m83, affecting the separate quoted-local-part code path. Version 10.0.9 contains a fix.","status":"published","published":"2026-09-26T13:23:55Z","modified":"2026-09-28T17:43:19Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T17:27:53.091489Z"}],"ghsa":[{"id":"GHSA-fcjc-3m4q-q926","title":"Nodemailer is a Node.js email-sending library. In versions \u003e= 9.1.0 and \u003c 10.0.9, the address...","description":"Nodemailer is a Node.js email-sending library. In versions \u003e= 9.1.0 and \u003c 10.0.9, the address parser (src/addressparser) mishandles addresses whose local-part is a quoted string and that are followed by RFC 5322 comments, allowing trailing comment-separated domain atoms to be retained in the normalized address. For example, the input \"user\"@example.com(x)evil.com is parsed to the address value 'user@example.com evil.com', which contains additional attacker-controlled domain text separated by a literal space. This parsed value is used without further strict recipient validation when the message envelope is built (envelope.to in src/mime-node), so a malformed/ambiguous recipient address can be accepted and placed in the SMTP envelope. Whether this results in delivery to an unintended recipient on real SMTP servers has not been confirmed. The issue is a variant of the RFC 5322 comment parsing problem addressed in GHSA-cc9r-2j5m-2m83, affecting the separate quoted-local-part code path. Version 10.0.9 contains a fix.","status":"published","published":"2026-09-26T15:31:22Z","modified":"2026-09-26T15:31:22Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:12:30.047516Z"},{"id":"GHSA-g57g-f23g-4646","title":"Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing","description":"## Summary\n\nNodemailer's address parser can produce an unexpected recipient address when an RFC 5322 comment follows the domain of an address whose local-part is a quoted string.\n\nFor example:\n\n```text\n\"user\"@example.com(x)evil.com\n```\n\nis parsed as:\n\n```text\n{\n  address: \"user@example.com evil.com\",\n  name: \"\"\n}\n```\n\nThe resulting address therefore contains additional attacker-controlled domain text separated by a literal space.\n\nThe parsed `.address` value is subsequently propagated into the SMTP envelope:\n\n```text\nsrc/addressparser/index.ts\n        ↓\nrecipient.address\n        ↓\nsrc/mime-node/index.ts\n        ↓\nenvelope.to\n```\n\nThe envelope construction uses the parsed address without another strict address validation step.\n\nThis appears to be a variant of the RFC 5322 comment parsing issue addressed by GHSA-cc9r-2j5m-2m83, but it follows a different parser path when the local-part is quoted.\n\n## Reproduction\n\nInput:\n\n```text\n\"user\"@example.com(x)evil.com\n```\n\nObserved parser output:\n\n```text\naddress: \"user@example.com evil.com\"\nname: \"\"\n```\n\nA second example:\n\n```text\n\"a\"@b.com(c)d.com(e)f.com\n```\n\nproduces:\n\n```text\naddress: \"a@b.com d.com f.com\"\nname: \"\"\n```\n\nFor comparison, the corresponding unquoted form:\n\n```text\nuser@example.com(x)evil.com\n```\n\ntakes a different code path and is handled by the existing protection differently.\n\n## Technical Details\n\nThe issue is caused by different parsing behavior for quoted and unquoted local-parts.\n\nThe quoted-local-part variant allows the comment-separated trailing domain atoms to remain in the resulting `.address` value.\n\nThat value is then used when constructing the message envelope:\n\n```text\nenvelope.to = recipients.map(to =\u003e to.address as string)\n```\n\nNo additional strict recipient validation is performed at this boundary.\n\n## Security Impact\n\nThe confirmed impact is that attacker-controlled comment content can result in a malformed/ambiguous recipient address being accepted by the parser and propagated into `envelope.to`.\n\nThe reporter did **not confirm successful delivery to an unintended recipient through a real SMTP server using this exact quoted-local-part variant**.\n\nThe remaining question is how real SMTP servers and other Nodemailer transports handle an envelope recipient containing a value such as:\n\n```text\nuser@example.com evil.com\n```\n\nAn end-to-end SMTP test is required to determine whether this parser behavior results in an exploitable delivery or recipient-validation bypass.\n\n## Relationship to GHSA-cc9r-2j5m-2m83\n\nThis report is intended as a potential variant/follow-up to GHSA-cc9r-2j5m-2m83.\n\nThe existing advisory addresses RFC 5322 comment handling in email domains. This report identifies a separate parser path involving quoted local-parts that can preserve additional domain-like content in the normalized address.\n\nPlease evaluate whether this behavior is already covered by the existing fix or represents a remaining parser variant.\n\n## Suggested Fix\n\nThe parser should consistently reject or correctly terminate addresses containing trailing domain atoms after RFC 5322 comments, regardless of whether the local-part is quoted.\n\nIn particular:\n\n```text\n\"user\"@example.com(x)evil.com\n```\n\nshould not result in:\n\n```text\nuser@example.com evil.com\n```\n\nThe envelope-generation layer should also avoid assuming that a parser-produced address is safe for SMTP delivery without appropriate validation.\n\n## Verification Status\n\nConfirmed:\n\n* Parser accepts the quoted-local-part variant.\n* Parser produces an address containing additional attacker-controlled text.\n* The resulting address is propagated into `envelope.to`.\n\nNot confirmed by reporter:\n\n* Successful delivery through a real SMTP server.\n* Delivery to an unintended recipient.\n* Exploitability against a specific downstream SMTP implementation.","status":"published","published":"2026-09-29T23:44:04Z","modified":"2026-09-29T23:44:05Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-20","CWE-436"],"updated_at":"2026-11-02T14:41:22.654187Z"}],"nvd":[{"id":"CVE-2026-100699","description":"Nodemailer is a Node.js email-sending library. In versions \u003e= 9.1.0 and \u003c 10.0.9, the address parser (src/addressparser) mishandles addresses whose local-part is a quoted string and that are followed by RFC 5322 comments, allowing trailing comment-separated domain atoms to be retained in the normalized address. For example, the input \"user\"@example.com(x)evil.com is parsed to the address value 'user@example.com evil.com', which contains additional attacker-controlled domain text separated by a literal space. This parsed value is used without further strict recipient validation when the message envelope is built (envelope.to in src/mime-node), so a malformed/ambiguous recipient address can be accepted and placed in the SMTP envelope. Whether this results in delivery to an unintended recipient on real SMTP servers has not been confirmed. The issue is a variant of the RFC 5322 comment parsing problem addressed in GHSA-cc9r-2j5m-2m83, affecting the separate quoted-local-part code path. Version 10.0.9 contains a fix.","status":"published","published":"2026-09-26T14:16:54.867Z","modified":"2026-09-30T16:32:17.94Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:12:52.081323Z"}],"osv":[{"id":"CVE-2026-100699","title":"Nodemailer before 10.0.9 Malformed Envelope Recipient via RFC 5322 Comment","description":"Nodemailer is a Node.js email-sending library. In versions \u003e= 9.1.0 and \u003c 10.0.9, the address parser (src/addressparser) mishandles addresses whose local-part is a quoted string and that are followed by RFC 5322 comments, allowing trailing comment-separated domain atoms to be retained in the normalized address. For example, the input \"user\"@example.com(x)evil.com is parsed to the address value 'user@example.com evil.com', which contains additional attacker-controlled domain text separated by a literal space. This parsed value is used without further strict recipient validation when the message envelope is built (envelope.to in src/mime-node), so a malformed/ambiguous recipient address can be accepted and placed in the SMTP envelope. Whether this results in delivery to an unintended recipient on real SMTP servers has not been confirmed. The issue is a variant of the RFC 5322 comment parsing problem addressed in GHSA-cc9r-2j5m-2m83, affecting the separate quoted-local-part code path. Version 10.0.9 contains a fix.","status":"published","published":"2026-09-26T13:23:55.786Z","modified":"2026-10-28T02:31:03.12427166Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:44:53.83521Z"},{"id":"DEBIAN-CVE-2026-100699","description":"Nodemailer is a Node.js email-sending library. In versions \u003e= 9.1.0 and \u003c 10.0.9, the address parser (src/addressparser) mishandles addresses whose local-part is a quoted string and that are followed by RFC 5322 comments, allowing trailing comment-separated domain atoms to be retained in the normalized address. For example, the input \"user\"@example.com(x)evil.com is parsed to the address value 'user@example.com evil.com', which contains additional attacker-controlled domain text separated by a literal space. This parsed value is used without further strict recipient validation when the message envelope is built (envelope.to in src/mime-node), so a malformed/ambiguous recipient address can be accepted and placed in the SMTP envelope. Whether this results in delivery to an unintended recipient on real SMTP servers has not been confirmed. The issue is a variant of the RFC 5322 comment parsing problem addressed in GHSA-cc9r-2j5m-2m83, affecting the separate quoted-local-part code path. Version 10.0.9 contains a fix.","status":"published","published":"2026-09-26T14:16:54.867Z","modified":"2026-10-01T08:47:38.488074268Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:48.440897Z"},{"id":"GHSA-g57g-f23g-4646","title":"Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing","description":"## Summary\n\nNodemailer's address parser can produce an unexpected recipient address when an RFC 5322 comment follows the domain of an address whose local-part is a quoted string.\n\nFor example:\n\n```text\n\"user\"@example.com(x)evil.com\n```\n\nis parsed as:\n\n```text\n{\n  address: \"user@example.com evil.com\",\n  name: \"\"\n}\n```\n\nThe resulting address therefore contains additional attacker-controlled domain text separated by a literal space.\n\nThe parsed `.address` value is subsequently propagated into the SMTP envelope:\n\n```text\nsrc/addressparser/index.ts\n        ↓\nrecipient.address\n        ↓\nsrc/mime-node/index.ts\n        ↓\nenvelope.to\n```\n\nThe envelope construction uses the parsed address without another strict address validation step.\n\nThis appears to be a variant of the RFC 5322 comment parsing issue addressed by GHSA-cc9r-2j5m-2m83, but it follows a different parser path when the local-part is quoted.\n\n## Reproduction\n\nInput:\n\n```text\n\"user\"@example.com(x)evil.com\n```\n\nObserved parser output:\n\n```text\naddress: \"user@example.com evil.com\"\nname: \"\"\n```\n\nA second example:\n\n```text\n\"a\"@b.com(c)d.com(e)f.com\n```\n\nproduces:\n\n```text\naddress: \"a@b.com d.com f.com\"\nname: \"\"\n```\n\nFor comparison, the corresponding unquoted form:\n\n```text\nuser@example.com(x)evil.com\n```\n\ntakes a different code path and is handled by the existing protection differently.\n\n## Technical Details\n\nThe issue is caused by different parsing behavior for quoted and unquoted local-parts.\n\nThe quoted-local-part variant allows the comment-separated trailing domain atoms to remain in the resulting `.address` value.\n\nThat value is then used when constructing the message envelope:\n\n```text\nenvelope.to = recipients.map(to =\u003e to.address as string)\n```\n\nNo additional strict recipient validation is performed at this boundary.\n\n## Security Impact\n\nThe confirmed impact is that attacker-controlled comment content can result in a malformed/ambiguous recipient address being accepted by the parser and propagated into `envelope.to`.\n\nThe reporter did **not confirm successful delivery to an unintended recipient through a real SMTP server using this exact quoted-local-part variant**.\n\nThe remaining question is how real SMTP servers and other Nodemailer transports handle an envelope recipient containing a value such as:\n\n```text\nuser@example.com evil.com\n```\n\nAn end-to-end SMTP test is required to determine whether this parser behavior results in an exploitable delivery or recipient-validation bypass.\n\n## Relationship to GHSA-cc9r-2j5m-2m83\n\nThis report is intended as a potential variant/follow-up to GHSA-cc9r-2j5m-2m83.\n\nThe existing advisory addresses RFC 5322 comment handling in email domains. This report identifies a separate parser path involving quoted local-parts that can preserve additional domain-like content in the normalized address.\n\nPlease evaluate whether this behavior is already covered by the existing fix or represents a remaining parser variant.\n\n## Suggested Fix\n\nThe parser should consistently reject or correctly terminate addresses containing trailing domain atoms after RFC 5322 comments, regardless of whether the local-part is quoted.\n\nIn particular:\n\n```text\n\"user\"@example.com(x)evil.com\n```\n\nshould not result in:\n\n```text\nuser@example.com evil.com\n```\n\nThe envelope-generation layer should also avoid assuming that a parser-produced address is safe for SMTP delivery without appropriate validation.\n\n## Verification Status\n\nConfirmed:\n\n* Parser accepts the quoted-local-part variant.\n* Parser produces an address containing additional attacker-controlled text.\n* The resulting address is propagated into `envelope.to`.\n\nNot confirmed by reporter:\n\n* Successful delivery through a real SMTP server.\n* Delivery to an unintended recipient.\n* Exploitability against a specific downstream SMTP implementation.","status":"published","published":"2026-09-29T23:44:04Z","modified":"2026-09-30T00:00:03.851424904Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-20","CWE-436"],"updated_at":"2026-11-02T15:46:47.119724Z"},{"id":"UBUNTU-CVE-2026-100699","description":"Nodemailer is a Node.js email-sending library. In versions \u003e= 9.1.0 and \u003c 10.0.9, the address parser (src/addressparser) mishandles addresses whose local-part is a quoted string and that are followed by RFC 5322 comments, allowing trailing comment-separated domain atoms to be retained in the normalized address. For example, the input \"user\"@example.com(x)evil.com is parsed to the address value 'user@example.com evil.com', which contains additional attacker-controlled domain text separated by a literal space. This parsed value is used without further strict recipient validation when the message envelope is built (envelope.to in src/mime-node), so a malformed/ambiguous recipient address can be accepted and placed in the SMTP envelope. Whether this results in delivery to an unintended recipient on real SMTP servers has not been confirmed. The issue is a variant of the RFC 5322 comment parsing problem addressed in GHSA-cc9r-2j5m-2m83, affecting the separate quoted-local-part code path. Version 10.0.9 contains a fix.","status":"published","published":"2026-09-26T14:16:00Z","modified":"2026-10-17T12:59:42.181122097Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:55:58.519486Z"},{"id":"CLSA-2026-1790854662","title":"TuxCare security update for nodemailer (4 CVEs)","description":"TuxCare rebuilt nodemailer to address 4 CVEs. Fixed in 9.1.0-tuxcare.4.","status":"published","published":"2026-10-01T11:37:42Z","modified":"2026-10-15T09:47:59.934055814Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1793790274","title":"TuxCare security update for nodemailer (2 CVEs)","description":"TuxCare rebuilt nodemailer to address 2 CVEs. Fixed in 9.0.6-tuxcare.8.","status":"published","published":"2026-11-04T12:04:34Z","modified":"2026-11-04T14:45:07.036757359Z","updated_at":"2026-11-04T15:03:54.132276Z"},{"id":"CLSA-2026-1793801901","title":"TuxCare security update for nodemailer (1 CVE)","description":"TuxCare rebuilt nodemailer to address 1 CVE. Fixed in 9.0.5-tuxcare.9.","status":"published","published":"2026-11-04T15:18:22Z","modified":"2026-11-04T19:00:36.388434572Z","updated_at":"2026-11-04T19:15:03.6858Z"},{"id":"CLSA-2026-1793808867","title":"TuxCare security update for nodemailer (1 CVE)","description":"TuxCare rebuilt nodemailer to address 1 CVE. Fixed in 9.0.3-tuxcare.8.","status":"published","published":"2026-11-04T17:14:28Z","modified":"2026-11-04T19:00:35.342093052Z","updated_at":"2026-11-04T19:15:03.6858Z"},{"id":"CLSA-2026-1793814042","title":"TuxCare security update for nodemailer (1 CVE)","description":"TuxCare rebuilt nodemailer to address 1 CVE. Fixed in 9.0.2-tuxcare.9.","status":"published","published":"2026-11-04T18:40:43Z","modified":"2026-11-05T01:00:02.595295976Z","updated_at":"2026-11-05T01:12:05.565404Z"},{"id":"CLSA-2026-1793828946","title":"TuxCare security update for nodemailer (1 CVE)","description":"TuxCare rebuilt nodemailer to address 1 CVE. Fixed in 9.0.1-tuxcare.7.","status":"published","published":"2026-11-04T22:49:07Z","modified":"2026-11-05T01:00:03.61247087Z","updated_at":"2026-11-05T01:12:05.565404Z"},{"id":"CLSA-2026-1793874971","title":"TuxCare security update for nodemailer (1 CVE)","description":"TuxCare rebuilt nodemailer to address 1 CVE. Fixed in 9.0.0-tuxcare.10.","status":"published","published":"2026-11-05T11:36:12Z","modified":"2026-11-05T13:15:17.980535917Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1793882612","title":"TuxCare security update for nodemailer (1 CVE)","description":"TuxCare rebuilt nodemailer to address 1 CVE. Fixed in 6.10.1-tuxcare.18.","status":"published","published":"2026-11-05T13:43:33Z","modified":"2026-11-06T13:15:17.598485545Z","updated_at":"2026-11-06T13:44:09.891978Z"}]}}