Nodemailer contains a vulnerability in its email parsing logic where quoted local-parts containing '@' characters are improperly handled. This causes emails to be misrouted to unintended external domains instead of the intended recipient, violating RFC 5321/5322 standards. The flaw can lead to data leakage, filter evasion, and bypass of domain-based access controls in downstream applications. The vulnerability affects Nodemailer versions prior to 7.0.7 and has been fixed in version 7.0.7.