{"schema":"threatline.record/2","record":{"id":"GHSA-g57g-f23g-4646","aliases":["CVE-2026-100699","GHSA-g57g-f23g-4646"],"summary":"Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing","details":"## Summary\n\nNodemailer's address parser can produce an unexpected recipient address when an RFC 5322 comment follows the domain of an address whose local-part is a quoted string.\n\nFor example:\n\n```text\n\"user\"@example.com(x)evil.com\n```\n\nis parsed as:\n\n```text\n{\n  address: \"user@example.com evil.com\",\n  name: \"\"\n}\n```\n\nThe resulting address therefore contains additional attacker-controlled domain text separated by a literal space.\n\nThe parsed `.address` value is subsequently propagated into the SMTP envelope:\n\n```text\nsrc/addressparser/index.ts\n        ↓\nrecipient.address\n        ↓\nsrc/mime-node/index.ts\n        ↓\nenvelope.to\n```\n\nThe envelope construction uses the parsed address without another strict address validation step.\n\nThis appears to be a variant of the RFC 5322 comment parsing issue addressed by GHSA-cc9r-2j5m-2m83, but it follows a different parser path when the local-part is quoted.\n\n## Reproduction\n\nInput:\n\n```text\n\"user\"@example.com(x)evil.com\n```\n\nObserved parser output:\n\n```text\naddress: \"user@example.com evil.com\"\nname: \"\"\n```\n\nA second example:\n\n```text\n\"a\"@b.com(c)d.com(e)f.com\n```\n\nproduces:\n\n```text\naddress: \"a@b.com d.com f.com\"\nname: \"\"\n```\n\nFor comparison, the corresponding unquoted form:\n\n```text\nuser@example.com(x)evil.com\n```\n\ntakes a different code path and is handled by the existing protection differently.\n\n## Technical Details\n\nThe issue is caused by different parsing behavior for quoted and unquoted local-parts.\n\nThe quoted-local-part variant allows the comment-separated trailing domain atoms to remain in the resulting `.address` value.\n\nThat value is then used when constructing the message envelope:\n\n```text\nenvelope.to = recipients.map(to => to.address as string)\n```\n\nNo additional strict recipient validation is performed at this boundary.\n\n## Security Impact\n\nThe confirmed impact is that attacker-controlled comment content can result in a malformed/ambiguous recipient address being accepted by the parser and propagated into `envelope.to`.\n\nThe reporter did **not confirm successful delivery to an unintended recipient through a real SMTP server using this exact quoted-local-part variant**.\n\nThe remaining question is how real SMTP servers and other Nodemailer transports handle an envelope recipient containing a value such as:\n\n```text\nuser@example.com evil.com\n```\n\nAn end-to-end SMTP test is required to determine whether this parser behavior results in an exploitable delivery or recipient-validation bypass.\n\n## Relationship to GHSA-cc9r-2j5m-2m83\n\nThis report is intended as a potential variant/follow-up to GHSA-cc9r-2j5m-2m83.\n\nThe existing advisory addresses RFC 5322 comment handling in email domains. This report identifies a separate parser path involving quoted local-parts that can preserve additional domain-like content in the normalized address.\n\nPlease evaluate whether this behavior is already covered by the existing fix or represents a remaining parser variant.\n\n## Suggested Fix\n\nThe parser should consistently reject or correctly terminate addresses containing trailing domain atoms after RFC 5322 comments, regardless of whether the local-part is quoted.\n\nIn particular:\n\n```text\n\"user\"@example.com(x)evil.com\n```\n\nshould not result in:\n\n```text\nuser@example.com evil.com\n```\n\nThe envelope-generation layer should also avoid assuming that a parser-produced address is safe for SMTP delivery without appropriate validation.\n\n## Verification Status\n\nConfirmed:\n\n* Parser accepts the quoted-local-part variant.\n* Parser produces an address containing additional attacker-controlled text.\n* The resulting address is propagated into `envelope.to`.\n\nNot confirmed by reporter:\n\n* Successful delivery through a real SMTP server.\n* Delivery to an unintended recipient.\n* Exploitability against a specific downstream SMTP implementation.","categories":["Libraries & packages"],"product":"nodemailer","vendor":"","ecosystem":"npm","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-g57g-f23g-4646","source_modified_at":"2026-09-29T23:44:05Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"nodemailer"},"range":">= 9.1.0, < 10.0.9"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-g57g-f23g-4646","source_modified_at":"2026-09-30T00:00:03.851424904Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"nodemailer","ecosystem":"npm","purl":"pkg:npm/nodemailer"},"ranges":[{"type":"SEMVER","events":[{"introduced":"9.1.0"},{"fixed":"10.0.9"}]}],"versions":[]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-g57g-f23g-4646","source_modified_at":"2026-09-29T23:44:05Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"nodemailer"},"version":"10.0.9"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-g57g-f23g-4646","source_modified_at":"2026-09-30T00:00:03.851424904Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"nodemailer","ecosystem":"npm","purl":"pkg:npm/nodemailer"},"version":"10.0.9"}],"cvss":5.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-09-29T23:44:04Z","modified_at":"2026-09-30T00:00:03.851424904Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-g57g-f23g-4646","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-29T23:44:05Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-g57g-f23g-4646","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-09-30T00:00:03.851424904Z"}],"sources":["GitHub Advisory Database","OSV"],"references":[{"url":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-g57g-f23g-4646","source":"GitHub Advisory Database"},{"url":"https://github.com/nodemailer/nodemailer/commit/2f36eb1aa1dd33e312411dc9b888548e14db54ee","source":"GitHub Advisory Database"},{"url":"https://github.com/nodemailer/nodemailer/releases/tag/v10.0.9","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-g57g-f23g-4646","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-09-30T00:00:03.851424904Z","content_hash":"2229685a432239786acd542b1f3f144c721a73c76ca98e645313390a1f68242d"}}