Threats tagged 'ghsa-crhf-rr59-7pch'

Nodemailer versions from 3.0.0 up to but not including 10.1.4 contain an address parsing vulnerability in the addressparser component. This flaw causes the parser to incorrectly end an angle-addr at a '>' character inside a quoted local part, comment, or domain literal. As a result, attackers can craft email addresses that appear to belong to allowed domains but are actually delivered to attacker-controlled domains, bypassing recipient allow lists and potentially exposing message content.