Email Parsing Vulnerability in Nodemailer by Nodemailer

CVE-2026-100699

What is CVE-2026-100699?

The Nodemailer library, essential for sending emails in Node.js applications, contains a vulnerability affecting its address parsing capability. Specifically, in versions between 9.1.0 and 10.0.9, the library mishandles email addresses where the local-part is enclosed in quotes and followed by RFC 5322 comments. This flaw can lead to the parsing of addresses in an unintended manner, potentially allowing attacker-controlled domain information to be included within the normalized address. As a consequence, a malformed or ambiguous recipient address may slip through undetected during the SMTP envelope construction stage, raising the risk of unintentional email delivery. The issue stems from a known problem with RFC 5322 comment handling but specifically impacts addresses that feature quoted local-parts. Users are advised to upgrade to version 10.0.9 or later, which resolves this vulnerability.

References