Nodemailer, a Node.js email-sending library, has a vulnerability (CVE-2026-100699) in its address parser (src/addressparser) affecting versions >=9.1.0 and <10.0.9. The parser mishandles email addresses whose local-part is a quoted string followed by RFC 5322 comments, allowing additional attacker-controlled domain text to be appended to the normalized address. This malformed address is used without strict recipient validation when building the SMTP envelope, potentially allowing ambiguous recipient addresses. The vulnerability is a variant of a known RFC 5322 comment parsing problem and is fixed in version 10.0.9.

The vulnerability allows injection of additional domain atoms into the normalized email address used in the SMTP envelope, which could lead to malformed recipient addresses. However, it is not confirmed whether this results in email delivery to unintended recipients on real SMTP servers. The impact is limited to integrity of recipient address parsing without direct confidentiality or availability effects.

Upgrade Nodemailer to version 10.0.9 or later, where this address parser vulnerability is fixed. No other mitigation is indicated or required.