---
id: GHSA-g57g-f23g-4646
title: >-
  Nodemailer: Quoted local-part can produce malformed envelope recipient through
  RFC 5322 comment parsing
summary: >-
  Nodemailer: Quoted local-part can produce malformed envelope recipient through
  RFC 5322 comment parsing
severity: medium
cvss: 5.3
cwe:
  - CWE-20
  - CWE-436
vendor: nodemailer
product: nodemailer
ecosystem: npm
affected:
  - 'nodemailer >= 9.1.0, < 10.0.9'
patched:
  - nodemailer 10.0.9
published: '2026-09-29'
updated: '2026-09-29'
sourceUpdated: '2026-09-29T23:44:05Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-g57g-f23g-4646'
references:
  - url: >-
      https://github.com/nodemailer/nodemailer/security/advisories/GHSA-g57g-f23g-4646
  - url: >-
      https://github.com/nodemailer/nodemailer/commit/2f36eb1aa1dd33e312411dc9b888548e14db54ee
  - url: 'https://github.com/nodemailer/nodemailer/releases/tag/v10.0.9'
  - url: 'https://github.com/advisories/GHSA-g57g-f23g-4646'
tags:
  - ghsa
  - npm
ingestedAt: '2026-09-29T23:52:50.540Z'
---

## Overview

## Summary

Nodemailer's address parser can produce an unexpected recipient address when an RFC 5322 comment follows the domain of an address whose local-part is a quoted string.

For example:

```text
"user"@example.com(x)evil.com
```

is parsed as:

```text
{
  address: "user@example.com evil.com",
  name: ""
}
```

The resulting address therefore contains additional attacker-controlled domain text separated by a literal space.

The parsed `.address` value is subsequently propagated into the SMTP envelope:

```text
src/addressparser/index.ts
        ↓
recipient.address
        ↓
src/mime-node/index.ts
        ↓
envelope.to
```

The envelope construction uses the parsed address without another strict address validation step.

This appears to be a variant of the RFC 5322 comment parsing issue addressed by GHSA-cc9r-2j5m-2m83, but it follows a different parser path when the local-part is quoted.

## Reproduction

Input:

```text
"user"@example.com(x)evil.com
```

Observed parser output:

```text
address: "user@example.com evil.com"
name: ""
```

A second example:

```text
"a"@b.com(c)d.com(e)f.com
```

produces:

```text
address: "a@b.com d.com f.com"
name: ""
```

For comparison, the corresponding unquoted form:

```text
user@example.com(x)evil.com
```

takes a different code path and is handled by the existing protection differently.

## Technical Details

The issue is caused by different parsing behavior for quoted and unquoted local-parts.

The quoted-local-part variant allows the comment-separated trailing domain atoms to remain in the resulting `.address` value.

That value is then used when constructing the message envelope:

```text
envelope.to = recipients.map(to => to.address as string)
```

No additional strict recipient validation is performed at this boundary.

## Security Impact

The confirmed impact is that attacker-controlled comment content can result in a malformed/ambiguous recipient address being accepted by the parser and propagated into `envelope.to`.

The reporter did **not confirm successful delivery to an unintended recipient through a real SMTP server using this exact quoted-local-part variant**.

The remaining question is how real SMTP servers and other Nodemailer transports handle an envelope recipient containing a value such as:

```text
user@example.com evil.com
```

An end-to-end SMTP test is required to determine whether this parser behavior results in an exploitable delivery or recipient-validation bypass.

## Relationship to GHSA-cc9r-2j5m-2m83

This report is intended as a potential variant/follow-up to GHSA-cc9r-2j5m-2m83.

The existing advisory addresses RFC 5322 comment handling in email domains. This report identifies a separate parser path involving quoted local-parts that can preserve additional domain-like content in the normalized address.

Please evaluate whether this behavior is already covered by the existing fix or represents a remaining parser variant.

## Suggested Fix

The parser should consistently reject or correctly terminate addresses containing trailing domain atoms after RFC 5322 comments, regardless of whether the local-part is quoted.

In particular:

```text
"user"@example.com(x)evil.com
```

should not result in:

```text
user@example.com evil.com
```

The envelope-generation layer should also avoid assuming that a parser-produced address is safe for SMTP delivery without appropriate validation.

## Verification Status

Confirmed:

* Parser accepts the quoted-local-part variant.
* Parser produces an address containing additional attacker-controlled text.
* The resulting address is propagated into `envelope.to`.

Not confirmed by reporter:

* Successful delivery through a real SMTP server.
* Delivery to an unintended recipient.
* Exploitability against a specific downstream SMTP implementation.

## Affected packages

- `nodemailer >= 9.1.0, < 10.0.9`

## Remediation

Upgrade to a patched release:

- `nodemailer 10.0.9`