Nodemailer 3.0.0 before 10.1.4 Recipient Injection via addressparser Group Parsing

Summary

Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon inside quoted display names or comments. Attackers can submit crafted group addresses that conformant validators approve, redirecting mail to attacker-chosen recipients and bypassing recipient allow lists.

Remediation

1. Inventory every nodemailer nodemailer deployment, including staging.
2. Upgrade nodemailer nodemailer to 10.1.4.
3. Confirm the running version after the upgrade.

References

• Advisoryhttps://github.com/nodemailer/nodemailer/security/advisories/GHSA-m943-m63m-w62w
• Advisoryhttps://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.1.4-recipient-injection-via-addressparser-group-parsing