Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing — nodemailer
Improper Input ValidationSummary
Nodemailer's address parser can produce an unexpected recipient address when an RFC 5322 comment follows the domain of an address whose local-part is a quoted string.
For example:
"user"@example.com(x)evil.com
is parsed as:
{
address: "[email protected] evil.com",
name: ""
}
The resulting address therefore contains additional attacker-controlled domain text separated by a literal space.
The parsed .address value is subsequently propagated into the SMTP envelope:
src/addressparser/index.ts
↓
recipient.address
↓
src/mime-node/index.ts
↓
envelope.to
The envelope construction uses the parsed address without another strict address validation step.
This appears to be a variant of the RFC 5322 comment parsing issue addressed by GHSA-cc9r-2j5m-2m83, but it follows a different parser path when the local-part is quoted.
Reproduction
Input:
"user"@example.com(x)evil.com
Observed parser output:
address: "[email protected] evil.com"
name: ""
A second example:
"a"@b.com(c)d.com(e)f.com
produces:
address: "[email protected] d.com f.com"
name: ""
For comparison, the corresponding unquoted form:
[email protected](x)evil.com
takes a different code path and is handled by the existing protection differently.
Technical Details
The issue is caused by different parsing behavior for quoted and unquoted local-parts.
The quoted-local-part variant allows the comment-separated trailing domain atoms to remain in the resulting .address value.
That value is then used when constructing the message envelope:
envelope.to = recipients.map(to => to.address as string)
No additional strict recipient validation is performed at this boundary.
Security Impact
The confirmed impact is that attacker-controlled comment content can result in a malformed/ambiguous recipient address being accepted by the parser and propagated into envelope.to.
The reporter did not confirm successful delivery to an unintended recipient through a real SMTP server using this exact quoted-local-part variant.
The remaining question is how real SMTP servers and other Nodemailer transports handle an envelope recipient containing a value such as:
[email protected] evil.com
An end-to-end SMTP test is required to determine whether this parser behavior results in an exploitable delivery or recipient-validation bypass.
Relationship to GHSA-cc9r-2j5m-2m83
This report is intended as a potential variant/follow-up to GHSA-cc9r-2j5m-2m83.
The existing advisory addresses RFC 5322 comment handling in email domains. This report identifies a separate parser path involving quoted local-parts that can preserve additional domain-like content in the normalized address.
Please evaluate whether this behavior is already covered by the existing fix or represents a remaining parser variant.
Suggested Fix
The parser should consistently reject or correctly terminate addresses containing trailing domain atoms after RFC 5322 comments, regardless of whether the local-part is quoted.
In particular:
"user"@example.com(x)evil.com
should not result in:
[email protected] evil.com
The envelope-generation layer should also avoid assuming that a parser-produced address is safe for SMTP delivery without appropriate validation.
Verification Status
Confirmed:
- Parser accepts the quoted-local-part variant.
- Parser produces an address containing additional attacker-controlled text.
- The resulting address is propagated into
envelope.to.
Not confirmed by reporter:
- Successful delivery through a real SMTP server.
- Delivery to an unintended recipient.
- Exploitability against a specific downstream SMTP implementation.
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime
Frequently Asked Questions
A security vulnerability is a weakness in software, hardware, or configuration that can be exploited to compromise confidentiality, integrity, or availability. Many vulnerabilities are tracked as CVEs (Common Vulnerabilities and Exposures), which provide a standardized identifier so teams can coordinate patching, mitigation, and risk assessment across tools and vendors.
CVSS (Common Vulnerability Scoring System) estimates technical severity, but it doesn't automatically equal business risk. Prioritize using context like internet exposure, affected asset criticality, known exploitation (proof-of-concept or in-the-wild), and whether compensating controls exist. A "Medium" CVSS on an exposed, production system can be more urgent than a "Critical" on an isolated, non-production host.
A vulnerability is the underlying weakness. An exploit is the method or code used to take advantage of it. A zero-day is a vulnerability that is unknown to the vendor or has no publicly available fix when attackers begin using it. In practice, risk increases sharply when exploitation becomes reliable or widespread.
Recurring findings usually come from incomplete Asset Discovery, inconsistent patch management, inherited images, and configuration drift. In modern environments, you also need to watch the software supply chain: dependencies, containers, build pipelines, and third-party services can reintroduce the same weakness even after you patch a single host. Unknown or unmanaged assets (often called Shadow IT) are a common reason the same issues resurface.
Use a simple, repeatable triage model: focus first on externally exposed assets, high-value systems (identity, VPN, email, production), vulnerabilities with known exploits, and issues that enable remote code execution or privilege escalation. Then enforce patch SLAs and track progress using consistent metrics so remediation is steady, not reactive.
SynScan combines attack surface monitoring and continuous security auditing to keep your inventory current, flag high-impact vulnerabilities early, and help you turn raw findings into a practical remediation plan.