{"id":"ghsa-ghsa-8c8m-p3m8-cjg8","seq":661307,"kind":"advisory","title":"Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient","url":"https://github.com/advisories/GHSA-8c8m-p3m8-cjg8","permalink":"https://vulnpulse.app/items/ghsa-ghsa-8c8m-p3m8-cjg8","summary":"影響: npm:nodemailer >= 3.0.0, < 10.1.4 → 10.1.4\nVulnerability summary RFC 5322 comments nest. addressparser ended a comment at the first ), including the one that closes a nested comment, and parsed the rest of the outer comment as header text. Victim (x(y) ) names v@victim.com with x(y) as a comment, and Nodemailer read it as the address evil@evil.com. This is the same shape as the escaped parenthesis fixed in 10.1.2, reached through nesting instead of a quoted-pair. Affected: 3.0.0 through 10.1.3. Attacker capabilities The attacker control…","severity":"medium","techs":["nodejs"],"cves":[],"tags":["GHSA-8c8m-p3m8-cjg8","nodemailer"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T21:53:04.000Z","fetched_at":"2026-10-24T04:50:51.468Z"}