AIKIDO-2026-19039
nodemailer is vulnerable to Improper Input Validation
65
Medium Risk
This Affects:
nodemailerTL;DR
The address parser treats an RFC 5322 comment inside an address as text that joins the atoms around it, so user@good-corp.com(x)evil.com is read as the single domain good-corp.comevil.com. An application that validates the recipient domain against an allow-list or a strict parser can approve one domain while Nodemailer delivers to a different, attacker-registrable one. This lets crafted recipient input bypass domain checks and misroute mail. The fix terminates the domain at a comment so the parsed address matches what validators see.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application validates recipient domains against an allow-list or trusts parsed address domains built from untrusted input.
Background info
nodemailer is vulnerable to Improper Input Validation in versions 6.9.16 - 9.0.6.
How to fix this
Upgrade the nodemailer library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.