## Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient

- 種別: advisory
- 重大度: medium
- 関連技術: nodejs
- 公開日時: 2026-10-23T21:51:52.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-m943-m63m-w62w)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-m943-m63m-w62w

影響: npm:nodemailer >= 3.0.0, < 10.1.4 → 10.1.4
Vulnerability summary addressparser ends an RFC 5322 group at the first ;, including one inside a quoted display name or a comment. The text after it is parsed again as top level recipients with the quoting flipped, so text that every conformant parser reads as a display name or comment becomes a live address. G: (a; ) ; names only v@victim.com, and Nodemailer read it as the single recipient evil@evil.com. Affected: 3.0.0 through 10.1.3. Attacker capabilities The attacker controls the text of a…