{"id":"ghsa-ghsa-g73g-hqqh-jr95","seq":1708812,"kind":"advisory","title":"Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped","url":"https://github.com/advisories/GHSA-g73g-hqqh-jr95","permalink":"https://vulnpulse.app/items/ghsa-ghsa-g73g-hqqh-jr95","summary":"影響: npm:nodemailer >= 3.0.0, <= 10.0.12 → 10.0.13\nNodemailer's address parser has three published, patched fixes for RFC 5322 comment ( ... ) handling inside an addr-spec: GHSA-cc9r-2j5m-2m83 (comment glued two domain atoms into one), GHSA-g57g-f23g-4646 (the same glue for a quoted local part), and the related ReDoS fixes GHSA-prgh-xp8r-p3m5 / GHSA-v53p-9fqp-m79j. All three fixes live in _handleAddress()'s joins / _recoverAddrSpec() logic in src/addressparser/index.ts, and that logic is exercised whenever the local text-accumulation path in th…","severity":"medium","techs":["nodejs"],"cves":[],"tags":["GHSA-g73g-hqqh-jr95","nodemailer"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-27T15:04:36.000Z","fetched_at":"2026-10-27T21:03:52.214Z"}