Nodemailer CVE-2026-100699

Exploitation requires that the hosting application forward externally-controlled recipient addresses to Nodemailer's address parser without performing its own strict recipient validation, and that the attacker supply an address whose local-part is a quoted string followed by an RFC 5322 comment (e.g. "user"@example.com(x)evil.com). Limiting factors: the real-world consequence of misdelivery is explicitly unconfirmed by the advisory and depends on how the downstream SMTP server interprets the space-separated envelope value; only application code that trusts Nodemailer's normalized output without revalidation is affected; and the impact is integrity-only (VI:L) with no confidentiality or availability effect.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N, score 6.9) describes a network-reachable, unauthenticated, integrity-only weakness with no confidentiality or availability impact - the 6.9 is driven mainly by the network vector, not by severe impact. This is a low-to-moderate real-world priority, not a high-urgency issue: there is no EPSS score, no CISA KEV listing, and no public exploit code identified, so exploitation is theoretical rather than observed. Critically, the description itself hedges the impact - 'Whether this results in delivery to an unintended recipient on real SMTP servers has not been confirmed' - meaning the VI:L integrity claim is a parsing-correctness defect whose downstream security consequence (misdelivery/recipient smuggling) is unproven. The 'Information Disclosure' tag conflicts with the CVSS vector, which shows VC:N (no confidentiality impact) and VI:L (integrity only); the tag appears mislabeled. Net: a genuine input-validation bug worth patching on the normal maintenance cadence, but not an emergency given unconfirmed real-world impact and no exploitation signals.

An application that passes externally-supplied recipient addresses to Nodemailer without its own strict validation receives an address such as "user"@example.com(x)evil.com; Nodemailer's parser normalizes this to 'user@example.com evil.com', smuggling an attacker-controlled domain atom into the SMTP envelope.to. Depending on how the receiving SMTP server interprets the space-separated value, the message could potentially be routed to or influenced by the injected domain. No public exploit code exists, and the practical delivery impact is explicitly unconfirmed by the advisory.