{"id":"ghsa-ghsa-m943-m63m-w62w","seq":661308,"kind":"advisory","title":"Nodemailer: A \";\" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient","url":"https://github.com/advisories/GHSA-m943-m63m-w62w","permalink":"https://vulnpulse.app/items/ghsa-ghsa-m943-m63m-w62w","summary":"影響: npm:nodemailer >= 3.0.0, < 10.1.4 → 10.1.4\nVulnerability summary addressparser ends an RFC 5322 group at the first ;, including one inside a quoted display name or a comment. The text after it is parsed again as top level recipients with the quoting flipped, so text that every conformant parser reads as a display name or comment becomes a live address. G: (a; ) ; names only v@victim.com, and Nodemailer read it as the single recipient evil@evil.com. Affected: 3.0.0 through 10.1.3. Attacker capabilities The attacker controls the text of a…","severity":"medium","techs":["nodejs"],"cves":[],"tags":["GHSA-m943-m63m-w62w","nodemailer"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T21:51:52.000Z","fetched_at":"2026-10-24T04:50:51.468Z"}