AIKIDO-2026-499819
nodemailer is vulnerable to Improper Input Validation
53
Medium Risk
This Affects:
nodemailerTL;DR
The addressparser recovers an addr-spec from a quoted local-part without restoring the quoting before it strips trailing text that follows an RFC 5322 comment. An input such as "user"@example.com(x)evil.com is normalized to user@example.com evil.com, so comment-supplied content is retained inside the address value. That normalized address flows into the SMTP envelope recipient without further validation, creating a parser differential between what is validated and what is delivered. The fix re-quotes the local-part before addr-spec recovery so the quoted path matches the unquoted path.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you build the SMTP envelope recipient from untrusted or user-supplied email address input.
Background info
nodemailer is vulnerable to Improper Input Validation in versions 9.1.0 - 10.0.8.
How to fix this
Upgrade the nodemailer library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.