Interpretation Conflictnodemailer is an Easy as cake e-mail sending from your Node.js applications
Affected versions of this package are vulnerable to Interpretation Conflict via the address parser (src/addressparser/index.ts) when processing angle-addr and group constructs. The tokenizer tracks only a single open operator and, once < or : is encountered, looks only for the closing > or ; without accounting for quoted strings, comments, or domain literals that may appear inside. A > character inside a quoted local part therefore terminates the angle-addr prematurely, so an input such as <"a@evil.com>"@good.com> is parsed as an address at evil.com rather than the RFC 5322-conformant mailbox "a@evil.com>"@good.com. Similarly, a ; inside a quoted display name or a comment prematurely closes a group, causing additional recipients to be injected into the envelope, so G: (a; <evil@evil.com>) <v@victim.com>; delivers only to evil@evil.com instead of v@victim.com.
How to fix Interpretation Conflict? Upgrade nodemailer to version 10.1.4 or higher.
| |
Interpretation Conflictnodemailer is an Easy as cake e-mail sending from your Node.js applications
Affected versions of this package are vulnerable to Interpretation Conflict via the address parser in src/addressparser/index.ts, where the tokenizer tracks only a single open operator and does not account for quoted strings, comments, or domain literals nested inside an angle-addr or group. An attacker who controls a recipient address can supply a value such as 'G: (a; <evil@evil.com>) <v@victim.com>;' to cause the parser to terminate the group at the ; inside the comment, resulting in evil@evil.com being added to the SMTP envelope as a recipient instead of, or in addition to, the intended address. Similarly, a quoted local part containing > prematurely closes an angle-addr, so <"a@evil.com>"@good.com> is resolved to evil.com rather than good.com.
How to fix Interpretation Conflict? Upgrade nodemailer to version 10.1.4 or higher.
| |
Interpretation Conflictnodemailer is an Easy as cake e-mail sending from your Node.js applications
Affected versions of this package are vulnerable to Interpretation Conflict via the address parser in src/addressparser/index.ts when processing email header values containing nested comments. RFC 5322 §3.2.2 defines comments as nestable, but the tokenizer ends a comment at the first ) encountered, so the ) closing an inner comment prematurely closes the outer one and releases the remaining comment text, including any address it contains, into the parsed header. An attacker can construct a To header such as Victim (x(y) <evil@evil.com>) <v@victim.com> to redirect delivery to evil@evil.com instead of the intended v@victim.com, because the envelope RCPT TO is derived from the same malformed parse.
How to fix Interpretation Conflict? Upgrade nodemailer to version 10.1.4 or higher.
| |
