CVE-2025-13033

The record

A vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient email addresses. An attacker can exploit this flaw by crafting a recipient address that embeds an external address within quotes. This causes the application to misdirect the email to the attacker's external address instead of the intended internal recipient. This could lead to a significant data leak of sensitive information and allow an attacker to bypass security filters and access controls.

Affected packages

Related vulnerabilities

• GHSA-p6gq-j5cr-w38f Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess… Also affects nodemailer
• GHSA-268h-hp4c-crq3 Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message… Also affects nodemailer
• GHSA-wqvq-jvpq-h66f Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message… Also affects nodemailer
• GHSA-r7g4-qg5f-qqm2 Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential… Also affects nodemailer
• GHSA-vvjj-xcjg-gr5g Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option… Also affects nodemailer
• GHSA-c7w3-x93f-qmm8 Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameter Also affects nodemailer
• GHSA-46j5-6fg5-4gv3 Duplicate Advisory: Nodemailer is vulnerable to DoS through Uncontrolled Recursion Also affects nodemailer
• CVE-2025-14874 Nodemailer is vulnerable to DoS through Uncontrolled Recursion Also affects nodemailer