Nodemailer Addressparser RFC 5322 Group Bypass

Executive Summary

This vulnerability affects Nodemailer versions 3.0.0 through 10.1.3. It involves a parsing flaw in the addressparser library where a semicolon inside quoted display names or comments prematurely ends an RFC 5322 group address. Attackers exploit this by crafting malicious group addresses that appear valid to parsers, redirecting emails to unintended recipients and bypassing recipient allow lists.

Useful 0 Not Useful 0

Detection Guidance

Check Nodemailer version with: npm list nodemailer. If version is between 3.0.0 and 10.1.3, the system is vulnerable. Review email logs for suspicious recipient patterns like semicolons in display names or unexpected redirections.

Useful 0 Not Useful 0

Impact Analysis

If you use Nodemailer in versions 3.0.0 to 10.1.3, an attacker could manipulate email address fields to redirect emails to their chosen addresses. This could lead to unauthorized disclosure of email content, bypass security controls, and expose sensitive information to unintended parties.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized disclosure of personal or sensitive data, violating GDPR's data protection principles and HIPAA's confidentiality requirements. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Nodemailer to version 10.1.4 or later immediately. If upgrading is not possible, review and sanitize all email address inputs to remove semicolons in quoted strings or comments before passing them to Nodemailer.

Useful 0 Not Useful 0