Threats tagged 'ghsa-f6c5-wvmr-hc29'

Nodemailer versions from 3.0.0 up to but not including 10.1.4 contain an address parsing vulnerability in the addressparser component. This flaw allows remote attackers to craft email addresses with nested RFC 5322 comments that terminate prematurely, enabling recipient redirection. The vulnerability can bypass conformant validators and recipient allow lists, potentially allowing attackers to receive mail or spoof senders.