## Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped

- 種別: advisory
- 重大度: medium
- 関連技術: nodejs
- 公開日時: 2026-10-27T15:04:36.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-g73g-hqqh-jr95)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-g73g-hqqh-jr95

影響: npm:nodemailer >= 3.0.0, <= 10.0.12 → 10.0.13
Nodemailer's address parser has three published, patched fixes for RFC 5322 comment ( ... ) handling inside an addr-spec: GHSA-cc9r-2j5m-2m83 (comment glued two domain atoms into one), GHSA-g57g-f23g-4646 (the same glue for a quoted local part), and the related ReDoS fixes GHSA-prgh-xp8r-p3m5 / GHSA-v53p-9fqp-m79j. All three fixes live in _handleAddress()'s joins / _recoverAddrSpec() logic in src/addressparser/index.ts, and that logic is exercised whenever the local text-accumulation path in th…