Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name

• >= 3.0.0, < 10.1.4

### Vulnerability summary addressparser ends an angle-addr at the first `>` it sees, including one inside a quoted local part, a comment or a domain literal. The domain is then read off the text in front of that `>`. `"@good.com>` is the mailbox `"a@evil.com>"@good.com` under RFC 5322, and Nodemailer read it as an address at `evil.com`. The unbracketed spelling of the same value was already read correctly. Affected: 3.0.0 through 10.1.3. ### Attacker capabilities The attacker controls the text of a recipient or sender address that an application passes to Nodemailer, for example a To value entered in a contact or invite form, or the header of an inbound message parsed with mailparser. No access to the application, its configuration or its credentials is needed. The value is a syntactically valid RFC 5322 address that conformant parsers accept without defects. ### Realistic exploitation scenario An application lets users send invitations or notifications only to addresses at an allowed domain and validates the submitted value with a conformant parser or by checking its domain. The attacker submits `"@good.com>`, which validates as a `good.com` mailbox.

GitHub Advisory Database

• SEMVER: introduced 3.0.0; fixed 10.1.4

### Vulnerability summary addressparser ends an angle-addr at the first `>` it sees, including one inside a quoted local part, a comment or a domain literal. The domain is then read off the text in front of that `>`. `"@good.com>` is the mailbox `"a@evil.com>"@good.com` under RFC 5322, and Nodemailer read it as an address at `evil.com`. The unbracketed spelling of the same value was already read correctly. Affected: 3.0.0 through 10.1.3. ### Attacker capabilities The attacker controls the text of a recipient or sender address that an application passes to Nodemailer, for example a To value entered in a contact or invite form, or the header of an inbound message parsed with mailparser. No access to the application, its configuration or its credentials is needed. The value is a syntactically valid RFC 5322 address that conformant parsers accept without defects. ### Realistic exploitation scenario An application lets users send invitations or notifications only to addresses at an allowed domain and validates the submitted value with a conformant parser or by checking its domain. The attacker submits `"@good.com>`, which validates as a `good.com` mailbox.

GitHub Advisory Database via OSV