Threats tagged 'ghsa-fcjc-3m4q-q926'

Nodemailer versions from 9.1.0 up to but not including 10.0.9 have a vulnerability in the address parser. This flaw mishandles email addresses with quoted local-parts followed by RFC 5322 comments, causing trailing comment-separated domain atoms to remain in the normalized address. This can lead to malformed recipient addresses in the SMTP envelope. The issue is fixed in Nodemailer version 10.0.9.