GHSA-G73G-HQQH-JR95 Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped

Summary Nodemailer's address parser has three published, patched fixes for RFC 5322 comment ... handling inside an addr-spec: GHSA-cc9r-2j5m-2m83 comment glued two domain atoms into one, GHSA-g57g-f23g-4646 the same glue for a quoted local part, and the related ReDoS fixes GHSA-prgh-xp8r-p3m5 /...

Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped

Summary Nodemailer's address parser has three published, patched fixes for RFC 5322 comment ... handling inside an addr-spec: GHSA-cc9r-2j5m-2m83 comment glued two domain atoms into one, GHSA-g57g-f23g-4646 the same glue for a quoted local part, and the related ReDoS fixes GHSA-prgh-xp8r-p3m5 /...

Improper Adherence to Coding Standards

Overview org.webjars.npm:nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Improper Adherence to Coding Standards in the checkChar method of the Tokenizer class in src/addressparser/index.ts, where operatorExpecting hol...

Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing

Summary Nodemailer's address parser can produce an unexpected recipient address when an RFC 5322 comment follows the domain of an address whose local-part is a quoted string. For example: text "user"@example.comxevil.com is parsed as: text address: "[email protected] evil.com", name: "" The...

NPM: Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing

NPM: Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing vulnerability discovered by ? in WordPress Npm nodemailer versions = 9.1.0, 10.0.9...

CVE-2026-100699

Nodemailer is a Node.js email-sending library. In versions = 9.1.0 and 10.0.9, the address parser src/addressparser mishandles addresses whose local-part is a quoted string and that are followed by RFC 5322 comments, allowing trailing comment-separated domain atoms to be retained in the normalize...

DEBIAN-CVE-2026-100699

Nodemailer is a Node.js email-sending library. In versions = 9.1.0 and 10.0.9, the address parser src/addressparser mishandles addresses whose local-part is a quoted string and that are followed by RFC 5322 comments, allowing trailing comment-separated domain atoms to be retained in the normalize...

CVE-2026-100699

Nodemailer is a Node.js email-sending library. In versions = 9.1.0 and 10.0.9, the address parser src/addressparser mishandles addresses whose local-part is a quoted string and that are followed by RFC 5322 comments, allowing trailing comment-separated domain atoms to be retained in the normalize...

CVE-2026-100699 Nodemailer before 10.0.9 Malformed Envelope Recipient via RFC 5322 Comment

Nodemailer is a Node.js email-sending library. In versions = 9.1.0 and 10.0.9, the address parser src/addressparser mishandles addresses whose local-part is a quoted string and that are followed by RFC 5322 comments, allowing trailing comment-separated domain atoms to be retained in the normalize...

CVE-2026-100699 Nodemailer before 10.0.9 Malformed Envelope Recipient via RFC 5322 Comment

Nodemailer is a Node.js email-sending library. In versions = 9.1.0 and 10.0.9, the address parser src/addressparser mishandles addresses whose local-part is a quoted string and that are followed by RFC 5322 comments, allowing trailing comment-separated domain atoms to be retained in the normalize...

CVE-2026-100699 Nodemailer before 10.0.9 Malformed Envelope Recipient via RFC 5322 Comment

Nodemailer is a Node.js email-sending library. In versions = 9.1.0 and 10.0.9, the address parser src/addressparser mishandles addresses whose local-part is a quoted string and that are followed by RFC 5322 comments, allowing trailing comment-separated domain atoms to be retained in the normalize...

CVE-2026-100699

The Node.js email-sending library Nodemailer versions >= 9.1.0 and

CVE-2026-92597 Nodemailer before 9.1.0 Email Domain Validation Bypass via RFC 5322 Comment

Nodemailer versions = 6.9.16 and 9.1.0 mis-parse RFC 5322 comments in email addresses: in lib/addressparser, a comment closed immediately before a non-break character causes the tokenizer to concatenate the atoms surrounding the comment instead of treating the comment as folding whitespace that...

CVE-2026-92597 Nodemailer before 9.1.0 Email Domain Validation Bypass via RFC 5322 Comment

Nodemailer versions = 6.9.16 and 9.1.0 mis-parse RFC 5322 comments in email addresses: in lib/addressparser, a comment closed immediately before a non-break character causes the tokenizer to concatenate the atoms surrounding the comment instead of treating the comment as folding whitespace that...

CVE-2026-92597 Nodemailer before 9.1.0 Email Domain Validation Bypass via RFC 5322 Comment

Nodemailer versions = 6.9.16 and 9.1.0 mis-parse RFC 5322 comments in email addresses: in lib/addressparser, a comment closed immediately before a non-break character causes the tokenizer to concatenate the atoms surrounding the comment instead of treating the comment as folding whitespace that...

CVE-2026-92597

Nodemailer versions ≥ 6.9.16 and

PT-2026-95045

Summary Nodemailer's email-address parser treats an RFC 5322 comment ... inside the domain as a point to concatenate the surrounding text, rather than as folding whitespace CFWS that terminates the domain. Consequently a recipient address such as [email protected] is parsed and delivere...