GHSA-g57g-f23g-4646 — Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing

Affected: npm: nodemailer

## Summary

Nodemailer's address parser can produce an unexpected recipient address when an RFC 5322 comment follows the domain of an address whose local-part is a quoted string.

For example:

```text "user"@example.com(x)evil.com ```

is parsed as:

```text { address: "user@example.com evil.com", name: "" } ```

The resulting address therefore contains additional attacker-controlled domain text separated by a literal space.

The parsed `.address` value is subsequently propagated into the SMTP envelope:

```text src/addressparser/index.ts ↓ recipient.address ↓ src/mime-node/index.ts ↓ envelope.to ```

The envelope construction uses the parsed address without another strict address validation step.

This appears to be a variant of the RFC 5322 comment parsing issue addressed by GHSA-cc9r-2j5m-2m83, but it follows a different parser path when the local-part is quoted.

## Reproduction

Input:

```text "user"@example.com(x)evil.com ```

Observed parser output:

```text address: "user@example.com evil.com" name: "" ```

A second example:

```text "a"@b.com(c)d.com(e)f.com ```

produces:

```text address: "a@b.com d.com f.com" name: "" ```

For comparison, the corresponding unquoted form:

```text user@example.com(x)evil.com ```

takes a different code path and is handled by the existing protection differently.

## Technical Details

The issue is caused by different parsing behavior for quoted and unquoted local-parts.

The quoted-local-part variant a…

Most recent entries from all

GHSA-g57g-f23g-4646 — Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing