{"id":"ghsa-ghsa-85x2-q946-cp5h","seq":661309,"kind":"advisory","title":"Nodemailer: A \">\" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name","url":"https://github.com/advisories/GHSA-85x2-q946-cp5h","permalink":"https://vulnpulse.app/items/ghsa-ghsa-85x2-q946-cp5h","summary":"影響: npm:nodemailer >= 3.0.0, < 10.1.4 → 10.1.4\nVulnerability summary addressparser ends an angle-addr at the first > it sees, including one inside a quoted local part, a comment or a domain literal. The domain is then read off the text in front of that >. \"@good.com> is the mailbox \"a@evil.com>\"@good.com under RFC 5322, and Nodemailer read it as an address at evil.com. The unbracketed spelling of the same value was already read correctly. Affected: 3.0.0 through 10.1.3. Attacker capabilities The attacker controls the text of a recipient or…","severity":"medium","techs":["nodejs"],"cves":[],"tags":["GHSA-85x2-q946-cp5h","nodemailer"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T21:51:18.000Z","fetched_at":"2026-10-24T04:50:51.468Z"}