GHSA-CC9R-2J5M-2M83: Parser Differential and Domain Validation Bypass in Nodemailer
Vulnerability ID: GHSA-CC9R-2J5M-2M83
CVSS Score: 9.1
Published: 2026-09-08
A critical parser differential vulnerability exists in Nodemailer prior to version 9.1.0. An attacker can bypass recipient-domain validation checks by utilizing RFC 5322 comments, leading to unauthorized email routing.
TL;DR
Parser misalignment in Nodemailer allows attackers to bypass email validation and route sensitive emails to unauthorized domains using RFC 5322 comments.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-436
- Attack Vector: Network
- CVSS: 9.1 (Critical)
- Impact: Unauthorized email routing and interception of sensitive credentials
- Exploit Status: PoC available
Affected Systems
- Nodemailer npm package versions < 9.1.0
-
nodemailer: < 9.1.0 (Fixed in:
9.1.0)
Code Analysis
Commit: 902b63e
Fix RFC 5322 comment parsing to prevent domain gluing
@@ -184,7 +184,14 @@
Mitigation Strategies
- Upgrade Nodemailer to version 9.1.0 or later.
- Validate and reject email addresses containing parentheses in application-level input fields.
Remediation Steps:
- Verify current Nodemailer version using npm list nodemailer.
- Execute npm install nodemailer@9.1.0 or update package.json.
- Deploy input validation filters to reject parentheses in input fields.
References
Read the full report for GHSA-CC9R-2J5M-2M83 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)