CVE-2026-100699 in Nodemailer
Summary
by MITRE • 09/26/2026
Nodemailer is a Node.js email-sending library. In versions >= 9.1.0 and < 10.0.9, the address parser (src/addressparser) mishandles addresses whose local-part is a quoted string and that are followed by RFC 5322 comments, allowing trailing comment-separated domain atoms to be retained in the normalized address. For example, the input "user"@example.com(x)evil.com is parsed to the address value '[email protected] evil.com', which contains additional attacker-controlled domain text separated by a literal space. This parsed value is used without further strict recipient validation when the message envelope is built (envelope.to in src/mime-node), so a malformed/ambiguous recipient address can be accepted and placed in the SMTP envelope. Whether this results in delivery to an unintended recipient on real SMTP servers has not been confirmed. The issue is a variant of the RFC 5322 comment parsing problem addressed in GHSA-cc9r-2j5m-2m83, affecting the separate quoted-local-part code path. Version 10.0.9 contains a fix.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/26/2026
Nodemailer is a widely used Node.js library for sending emails via SMTP and other transport mechanisms. In versions greater than or equal to 9.1.0 and less than 10.0.9, the address parser located in src/addressparser contains a logic flaw when handling email addresses where the local-part is enclosed in quotes and followed by RFC 5322 compliant comments. This specific code path fails to properly strip trailing domain atoms that are separated from the primary recipient address by comment delimiters. The vulnerability arises because the parser retains these additional, attacker-controlled domain segments within the normalized address string rather than discarding them as non-essential metadata or invalid syntax components.
The technical manifestation of this flaw can be observed when processing an input such as "user"example.com(x)evil.com. Instead of normalizing this to a clean recipient address like userexample.com, the parser produces a value containing '[email protected] evil.com'. This result includes the original domain followed by a literal space and then the attacker-controlled text evil.com. Because Nodemailer uses this parsed value directly when constructing the message envelope in src/mime-node without applying further strict validation to ensure the address conforms strictly to expected recipient formats, malformed or ambiguous addresses are accepted into the SMTP transaction. This behavior deviates from secure defaults that would typically reject such syntactically complex or potentially misleading inputs.
The operational impact of this vulnerability centers on the potential for email misdelivery or ambiguity in logging and auditing systems. While it has not been definitively confirmed whether real-world SMTP servers will deliver messages to unintended recipients based solely on this trailing text, the presence of attacker-controlled domain information within the envelope recipient field poses significant risks. Attackers could potentially exploit this to bypass simple string-matching security controls that check for specific domains or patterns in email headers and envelopes. Furthermore, it complicates forensic analysis since logs may record ambiguous addresses that do not clearly indicate the intended destination versus injected artifacts. This issue is a variant of the RFC 5322 comment parsing problem previously addressed in GHSA-cc9r-2j5m-2m83 but affects a distinct code path related to quoted local-parts, indicating incomplete remediation coverage for similar input handling flaws within the library.
From a classification perspective, this vulnerability aligns with CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component and CWE-610 External Control of Critical State Variable if interpreted as allowing unintended state modification during envelope construction. In terms of attack vectors, it relates to ATT&CK technique T1589 Gather Victim Identity Information through email address harvesting or manipulation, although the primary risk here is more aligned with input validation failures leading to potential injection-like behaviors in downstream mail transfer agents. The lack of strict recipient validation after parsing represents a failure in defense-in-depth principles where multiple layers should verify data integrity before transmission.
To mitigate this vulnerability, organizations using Nodemailer must upgrade immediately to version 10.0.9 or later, which contains the necessary fixes for both comment handling and quoted local-part processing paths. For environments unable to update promptly, implementing a secondary validation layer that strictly enforces RFC 5322 compliance on recipient addresses before passing them to Nodemailer is recommended. This external validation should reject any address containing spaces within the domain portion or unexpected trailing characters after standard parsing. Additionally, monitoring SMTP logs for unusual envelope recipients containing space-separated domains can help detect potential exploitation attempts in real-time until patches are applied across all affected systems.