EUVD-2026-81297
GHSA-8pjj-q6q6-qm29
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H because exploitation depends on a parser disagreement plus attacker domain registration; PR:N/UI:N as the attacker only supplies an address; C:H for email-content disclosure, I:L for header/envelope spoofing, A:N.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
6DescriptionCVE.org
Nodemailer versions >= 6.9.16 and < 9.1.0 mis-parse RFC 5322 comments in email addresses: in lib/addressparser, a comment closed immediately before a non-break character causes the tokenizer to concatenate the atoms surrounding the comment instead of treating the comment as folding whitespace that terminates the domain. A recipient address such as user@good-corp.com(x)evil.com is therefore read by Nodemailer as the single domain good-corp.comevil.com (registrable domain comevil.com, which an attacker can register) and used for both the SMTP envelope (RCPT TO) and the emitted To:/From: headers, while a conformant RFC 5322 parser terminates the domain at the comment and reads good-corp.com. An application that validates the recipient domain with a strict RFC 5322 parser (without inspecting parse defects) or a naive prefix/substring allow-list and then hands the raw address to Nodemailer can be induced to deliver mail to a domain the attacker controls. Fixed in 9.1.0.
AnalysisAI
Nodemailer versions 6.9.16 through 9.0.x mis-parse RFC 5322 comments inside recipient addresses, so a recipient written as 'user@good-corp.com(x)evil.com' is delivered by Nodemailer to 'good-corp.comevil.com' - a registrable domain an attacker can register - while a conformant RFC 5322 parser reads the domain as 'good-corp.com'. An unauthenticated remote attacker who can influence a recipient address can therefore reach a domain the sending application never approved, but only when the application makes its allow/deny decision on the domain using a strict RFC 5322 parser (without inspecting parse defects) or a naive prefix/substring allow-list and then hands the raw address to Nodemailer; the mis-parse propagates to both the SMTP envelope (RCPT TO) and the emitted To:/From: headers. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires ALL of: (1) the target application uses Nodemailer >= 6.9.16 and < 9.1.0; (2) the application accepts an attacker-influenced recipient address; (3) the application makes a trust/authorization decision by validating the recipient DOMAIN - either with a strict RFC 5322 parser used WITHOUT inspecting parse defects, or with a naive prefix/substring allow-list - and then passes the RAW address to Nodemailer; and (4) the attacker controls (registers) the registrable domain that results from the concatenation (e.g. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but conditional risk best treated as Moderate priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade nodemailer to 9.1.0 or later, which applies commit 902b63e935435c30f4025901c0902dce64cd8880 (PR #1848) and marks a closing comment as folding whitespace so that domains are no longer glued across a comment; consult GHSA-cc9r-2j5m-2m83 and the fixed release notes for the full change. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every service that depends on Nodemailer and enumerate exact installed versions, flagging anything in the affected 6.9.16 through 9.0.x range via lockfiles and SBOMs, then identify the specific code paths where recipient addresses originate from user-influenced input and where domain allow/deny decisions are made, because those are the only conditions under which this issue is exploitable. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig
Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat
The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a bi
crypto/rsa/rsa_ameth.c in OpenSSL 1.0.1 before 1.0.1q and 1.0.2 before 1.0.2e allows remote attackers to cause a denial
Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig
Command injection via Windows CreateProcess argument parsing affects multiple language runtimes and tooling (Node.js, PH
Same weakness CWE-436 – Interpretation Conflict
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today