Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped

影響: npm:nodemailer >= 3.0.0, <= 10.0.12 → 10.0.13

Nodemailer's address parser has three published, patched fixes for RFC 5322 comment ( ... ) handling inside an addr-spec: GHSA-cc9r-2j5m-2m83 (comment glued two domain atoms into one), GHSA-g57g-f23g-4646 (the same glue for a quoted local part), and the related ReDoS fixes GHSA-prgh-xp8r-p3m5 / GHSA-v53p-9fqp-m79j. All three fixes live in _handleAddress()'s joins / _recoverAddrSpec() logic in src/addressparser/index.ts, and that logic is exercised whenever the local text-accumulation path in th…

GitHub Advisory Databaseで読む

2026/10/28 00:04、GitHub Advisory Databaseが「Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「警告」(medium) です。関連する技術: JavaScript / Node.js。