Threats tagged 'ghsa-q9mw-f56c-cmvf'

Nodemailer versions from 3.0.0 up to but not including 10.1.4 have a parsing flaw in the addressparser component. This flaw causes an RFC 5322 group to end prematurely at a semicolon inside quoted display names or comments. Attackers can exploit this by submitting crafted group addresses that pass validation but redirect emails to attacker-controlled recipients, bypassing recipient allow lists.