npm: Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient

npm: Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient vulnerability discovered by ? in WordPress npm nodemailer versions = 3.0.0, 10.1.4...