Email Parsing Library Vulnerability in Nodemailer by Red Hat
CVE-2025-13033

7.5HIGH

Key Information:

Vendor

Nodemailer

Status
Nodemailer
Red Hat Ceph Storage 8.1
Red Hat Developer Hub 1.9
Red Hat Advanced Cluster Management For Kubernetes 2
Vendor
CVE Published:
14 November 2025

What is CVE-2025-13033?

A flaw in the email parsing library of Nodemailer allows an attacker to craft a malicious recipient email address that can embed an external address within quotes. This can result in the misdirection of emails, routing sensitive information to unintended recipients. The vulnerability could potentially allow an attacker to bypass security measures and access controls, leading to significant data exposure.

Affected Version(s)

nodemailer 0 < 7.0.7

Red Hat Ceph Storage 8.1 1777566546

Red Hat Developer Hub 1.9 1772573159

References

https://access.redhat.com/errata/RHSA-2026:15979
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:3751
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2025-13033
vdb-entryx_refsource_REDHAT

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.