CVE-2026-100699
Received Received - Intake

Nodemailer Email Address Parsing Flaw Allows SMTP Envelope Manipulation

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Nodemailer is a Node.js email-sending library. In versions >= 9.1.0 and < 10.0.9, the address parser (src/addressparser) mishandles addresses whose local-part is a quoted string and that are followed by RFC 5322 comments, allowing trailing comment-separated domain atoms to be retained in the normalized address. For example, the input "user"@example.com(x)evil.com is parsed to the address value 'user@example.com evil.com', which contains additional attacker-controlled domain text separated by a literal space. This parsed value is used without further strict recipient validation when the message envelope is built (envelope.to in src/mime-node), so a malformed/ambiguous recipient address can be accepted and placed in the SMTP envelope. Whether this results in delivery to an unintended recipient on real SMTP servers has not been confirmed. The issue is a variant of the RFC 5322 comment parsing problem addressed in GHSA-cc9r-2j5m-2m83, affecting the separate quoted-local-part code path. Version 10.0.9 contains a fix.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100699
EUVD
EUVD-2026-87672

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
nodemailer nodemailer From 9.1.0 (inc) to 10.0.9 (exc)
nodemailer nodemailer 10.0.9

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Nodemailer versions 9.1.0 through 10.0.8. It involves improper input validation in the address parser when handling email addresses with quoted local-parts followed by RFC 5322 comments. This allows trailing domain atoms separated by comments to be retained in the normalized address, which is then used without strict validation when constructing the SMTP envelope.

Detection Guidance

To detect this vulnerability, check the installed version of Nodemailer in your Node.js project using 'npm list nodemailer'. If the version is between 9.1.0 and 10.0.8, the system is vulnerable. Additionally, review application logs for email addresses with quoted local-parts followed by RFC 5322 comments, such as 'user'@example.com(x)evil.com.

Impact Analysis

A malformed or ambiguous recipient address could be accepted and placed in the SMTP envelope, potentially leading to unintended email delivery. While it is not confirmed whether this results in actual delivery to unintended recipients via SMTP, the risk of misrouted emails exists.

Mitigation Strategies

Immediately update Nodemailer to version 10.0.9 or later using 'npm update nodemailer'. If updating is not possible, implement strict input validation for email addresses to reject malformed inputs with quoted local-parts followed by comments. Review SMTP envelope configurations to ensure recipient addresses are validated before sending.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100699. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart