nodemailer Email Parsing Library interpretation conflict

Summaryinfo

A vulnerability was found in nodemailer. It has been rated as problematic. Impacted is an unknown function of the component Email Parsing Library. Performing a manipulation results in interpretation conflict. This vulnerability is known as CVE-2025-13033. Remote exploitation of the attack is possible. No exploit is available. It is recommended to apply a patch to fix this issue.

Detailsinfo

A vulnerability, which was classified as problematic, was found in nodemailer (version unknown). This affects an unknown function of the component Email Parsing Library. The manipulation with an unknown input leads to a interpretation conflict vulnerability. CWE is classifying the issue as CWE-436. Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state. This is going to have an impact on confidentiality. The summary by CVE is:

A vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient email addresses. An attacker can exploit this flaw by crafting a recipient address that embeds an external address within quotes. This causes the application to misdirect the email to the attacker's external address instead of the intended internal recipient. This could lead to a significant data leak of sensitive information and allow an attacker to bypass security filters and access controls.

It is possible to read the advisory at access.redhat.com. This vulnerability is uniquely identified as CVE-2025-13033 since 11/11/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 275479 (Linux Distros Unpatched Vulnerability : CVE-2025-13033), which helps to determine the existence of the flaw in a target environment.

Applying the patch 1150d99fba77280df2cfb1885c43df23109a8626 is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the databases at Tenable (275479) and EUVD (EUVD-2025-197647). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• nodemailer

License

• open-source

Website

• Product: https://github.com/nodemailer/nodemailer/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion