Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name
影響: npm:nodemailer >= 3.0.0, < 10.1.4 → 10.1.4
Vulnerability summary addressparser ends an angle-addr at the first > it sees, including one inside a quoted local part, a comment or a domain literal. The domain is then read off the text in front of that >. "@good.com> is the mailbox "a@evil.com>"@good.com under RFC 5322, and Nodemailer read it as an address at evil.com. The unbracketed spelling of the same value was already read correctly. Affected: 3.0.0 through 10.1.3. Attacker capabilities The attacker controls the text of a recipient or…
| 情報源 | GitHub Advisory Database |
|---|---|
| 取得日時 | 2026/10/24 13:50 |
| データ | Markdown JSON |
2026/10/24 06:51、GitHub Advisory Databaseが「Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「警告」(medium) です。関連する技術: JavaScript / Node.js。