Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient
影響: npm:nodemailer >= 3.0.0, < 10.1.4 → 10.1.4
Vulnerability summary RFC 5322 comments nest. addressparser ended a comment at the first ), including the one that closes a nested comment, and parsed the rest of the outer comment as header text. Victim (x(y) ) names v@victim.com with x(y) as a comment, and Nodemailer read it as the address evil@evil.com. This is the same shape as the escaped parenthesis fixed in 10.1.2, reached through nesting instead of a quoted-pair. Affected: 3.0.0 through 10.1.3. Attacker capabilities The attacker control…
| 정보원 | GitHub Advisory Database |
|---|---|
| 수집 시각 | 2026. 10. 24. 오후 01:50 |
| 데이터 | Markdown JSON |
2026. 10. 24. 오전 06:53, GitHub Advisory Database에서 "Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: JavaScript / Node.js.