Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped
影響: npm:nodemailer >= 3.0.0, <= 10.0.12 → 10.0.13
Nodemailer's address parser has three published, patched fixes for RFC 5322 comment ( ... ) handling inside an addr-spec: GHSA-cc9r-2j5m-2m83 (comment glued two domain atoms into one), GHSA-g57g-f23g-4646 (the same glue for a quoted local part), and the related ReDoS fixes GHSA-prgh-xp8r-p3m5 / GHSA-v53p-9fqp-m79j. All three fixes live in _handleAddress()'s joins / _recoverAddrSpec() logic in src/addressparser/index.ts, and that logic is exercised whenever the local text-accumulation path in th…
Read on GitHub Advisory Database
| Source | GitHub Advisory Database |
|---|---|
| Fetched | 10/28/2026, 06:03 AM |
| Data | Markdown JSON |
On 10/28/2026, 12:04 AM, GitHub Advisory Database published "Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped" (type: Advisory). Severity is "Medium" (medium). Related technologies: JavaScript / Node.js.