PT-2026-135856

Vulnerability summary addressparser ends an angle-addr at the first it sees, including one inside a quoted local part, a comment or a domain literal. The domain is then read off the text in front of that . "@good.com is the mailbox "[email protected]"@good.com under RFC 5322, and Nodemailer read it as a...