CVE-2026-100699: Nodemailer Quoted Local-Part Vulnerability Leading to Malformed Envelope Recipient
Summary
CVE-2026-100699: Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing. Affects nodemailer versions >= 9.1.0, < 10.0.9. Fixed in 10.0.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Nodemailer is a widely used email sending library for Node.js applications, enabling developers to send emails easily. It supports various transport methods and is known for its simplicity and flexibility. However, it has a vulnerability related to its address parsing mechanism, specifically when handling quoted local-parts in email addresses, which can lead to malformed recipient addresses.
Vulnerability Detail
The vulnerability arises from Nodemailer's address parser, which can produce unexpected recipient addresses when an RFC 5322 comment follows the domain of an address with a quoted local-part. For instance, an input like '"user"@example.com(x)evil.com' is incorrectly parsed as 'user@example.com evil.com', allowing attacker-controlled content to be included in the recipient address. This issue can potentially lead to delivery to unintended recipients if the malformed address is accepted by SMTP servers, although successful exploitation has not been confirmed.
How To Fix
Latest published version: 10.2.1 as of 22 Oct 2026
npm install nodemailer@10.2.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
10.0.9
This is the first release that contains the fix.
npm install nodemailer@10.0.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement additional validation on email addresses before they are processed by Nodemailer to ensure they do not contain unexpected comments or additional domain-like content. For example, you could use a regular expression to validate the format of email addresses.
Conclusion
In summary, CVE-2026-100699 is a vulnerability in Nodemailer that can lead to malformed envelope recipient addresses due to improper parsing of quoted local-parts. It is crucial to update to the patched version to mitigate this risk and ensure proper email delivery.
See every vulnerability recorded for nodemailer →
FAQ
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The potential consequences include the acceptance of malformed recipient addresses, which could lead to emails being sent to unintended recipients.
As of now, there is no confirmed exploit that successfully delivers emails to unintended recipients using this vulnerability.
If you cannot update Nodemailer immediately, implement additional validation on email addresses to prevent malformed addresses from being processed.
References
Related vulnerabilities
Recent vulnerabilities recorded for nodemailer.
