5 matches found
GHSA-G57G-F23G-4646 Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing
Summary Nodemailer's address parser can produce an unexpected recipient address when an RFC 5322 comment follows the domain of an address whose local-part is a quoted string. For example: text "user"@example.comxevil.com is parsed as: text address: "[email protected] evil.com", name: "" The...
NPM: Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing
NPM: Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing vulnerability discovered by ? in WordPress Npm nodemailer versions = 9.1.0, 10.0.9...
Improper Validation of Specified Quantity in Input
Overview nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via the addressparser module's handling of quoted local-part addresses. When an address of the form...
CVE-2026-53533 aiosmtplib: SMTP command injection via CR/LF in sender/recipient address
aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.1, SMTP.mail, SMTP.rcpt, SMTP.vrfy, and SMTP.expn send caller-supplied addresses without rejecting embedded CR or LF bytes. Data after the line break is framed as additional standalone SMTP command lines, allowing an...