Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient

Vulnerability summary RFC 5322 comments nest. addressparser ended a comment at the first , including the one that closes a nested comment, and parsed the rest of the outer comment as header text. Victim xy names [email protected] with xy as a comment, and Nodemailer read it as the address [email protected]...