{"uuid": "34e5ac29-7144-40ae-8153-1948260921b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-G57G-F23G-4646", "type": "seen", "source": "https://gist.github.com/alon710/6ba550a2d55f00b6ee3c27bc53648140", "content": "# GHSA-G57G-F23G-4646: GHSA-G57G-F23G-4646: Parser Differential and SMTP Injection in Nodemailer Address Parser\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-09-29\n> **Full Report:** https://cvereports.com/reports/GHSA-G57G-F23G-4646\n\n## Summary\nNodemailer versions prior to 10.0.9 are vulnerable to a parser differential bug. When processing a quoted local-part followed by an RFC 5322 comment and trailing characters, the internal addressparser module fails to order its normalization routine correctly. This error results in the generation of malformed envelope recipient addresses containing injected whitespace and secondary domains, allowing attackers to bypass routing restrictions and exfiltrate sensitive emails.\n\n## TL;DR\nA parser logic flaw in Nodemailer allows attackers to inject secondary domains and spaces into email envelopes, leading to routing bypasses and email interception.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **Vulnerability Type**: Parser Differential / SMTP Parameter Injection\n- **CWE ID**: CWE-20\n- **Attack Vector**: Network / Input-driven\n- **Affected Component**: src/addressparser/index.ts\n- **Exploit Status**: Proof of Concept\n- **Remediation Status**: Official Patch Available (v10.0.9)\n\n## Affected Systems\n\n- Node.js applications using Nodemailer for SMTP transport\n- Upstream systems relying on domain-level email whitelisting\n- **nodemailer**: < 10.0.9 (Fixed in: `10.0.9`)\n\n## Mitigation\n\n- Upgrade Nodemailer to version 10.0.9 or higher\n- Implement strict upstream validation filtering out parenthesis and quotes in user email submissions\n- Configure the Mail Transfer Agent (MTA) to reject SMTP envelopes containing whitespace or malformed recipient fields\n\n**Remediation Steps:**\n1. Run npm install nodemailer@10.0.9 to update the package\n2. Verify the dependency tree using npm list nodemailer\n3. Deploy upstream input validation filters as a defense-in-depth measure\n\n## References\n\n- [GitHub Security Advisory GHSA-G57G-F23G-4646](https://github.com/advisories/GHSA-G57G-F23G-4646)\n- [Nodemailer Fix Commit 2f36eb1](https://github.com/nodemailer/nodemailer/commit/2f36eb1aa1dd33e312411dc9b888548e14db54ee)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-G57G-F23G-4646) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-30T11:30:30.000000Z"}