Skip to content
Heist/ feed
Back to feed
High

Nodemailer: nodemailer: email to an unintended domain can occur due to interpretation conflict

Type: advisorySources: OSV

A vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient email addresses. An attacker can exploit this flaw by crafting a recipient address that embeds an external address within quotes. This causes the application to misdirect the email to the attacker's external address instead of the intended internal recipient. This could lead to a significant data leak of sensitive information and allow an attacker to bypass security filters and access controls.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2025-13033
Confirmed fixed CVEs
Not specified
Updated in this feed
7 Nov 2026, 11:14 UTC · Revision 1

Source evidence

Nodemailer: nodemailer: email to an unintended domain can occur due to interpretation conflict

core-osv · Original source

Published 14 Nov 2025, 19:37 UTC

A vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient email addresses. An attacker can exploit this flaw by crafting a recipient address that embeds an external address within quotes. This causes the application to misdirect the email to the attacker's external address instead of the intended internal recipient. This could lead to a significant data leak of sensitive information and allow an attacker to bypass security filters and access controls.

osv:CVE-2025-13033
Complete source record
{
  "id": "16929617c8ac0d0942e6ff8252834bf4c58c7f1761101dfead88305407221b61",
  "url": "https://osv.dev/vulnerability/CVE-2025-13033",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Nodemailer: nodemailer: email to an unintended domain can occur due to interpretation conflict",
    "summary": "A vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient email addresses. An attacker can exploit this flaw by crafting a recipient address that embeds an external address within quotes. This causes the application to misdirect the email to the attacker's external address instead of the intended internal recipient. This could lead to a significant data leak of sensitive information and allow an attacker to bypass security filters and access controls.",
    "evidence": "osv:CVE-2025-13033",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2025-13033",
      "aliases": [
        "CVE-2025-13033",
        "GHSA-mm7p-fcc7-pg87"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/nodemailer/nodemailer",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "9357a712330132e16900769e8e3e9b4b7a8d2a4b"
                },
                {
                  "fixed": "1150d99fba77280df2cfb1885c43df23109a8626"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "7.0.7"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "fixed": "1150d99fba77280df2cfb1885c43df23109a8626"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v7.0.6",
            "v7.0.5",
            "v6.9.16",
            "v6.9.15",
            "v6.9.14",
            "v6.9.13",
            "v6.9.10",
            "v6.9.8",
            "v6.9.7",
            "v6.9.6",
            "v6.9.5",
            "v6.9.4",
            "v6.9.3",
            "v6.9.2",
            "v6.9.1",
            "v6.9.0",
            "v6.8.0",
            "v6.7.8",
            "v6.7.7",
            "v6.7.6",
            "v6.7.5",
            "v6.7.4",
            "v6.7.3",
            "v6.7.2",
            "v6.7.1",
            "v6.7.0",
            "v6.6.5",
            "v6.6.4",
            "v6.6.3",
            "v6.6.1",
            "v6.6.0",
            "v6.5.0",
            "v6.4.18",
            "v6.4.17",
            "v6.4.16",
            "v6.4.15",
            "v6.4.14",
            "v6.4.13",
            "v6.4.12",
            "v6.4.11",
            "v6.4.10",
            "v6.4.8",
            "v6.4.7",
            "v6.4.6",
            "v6.4.5",
            "v6.4.4",
            "v6.4.3",
            "v6.4.2",
            "v6.4.1",
            "v6.4.0",
            "v6.3.1",
            "v6.3.0",
            "v6.2.1",
            "v6.2.0",
            "v6.1.1",
            "v6.1.0",
            "v6.0.0",
            "v5.1.1",
            "v5.1.0",
            "v5.0.1",
            "v5.0.0",
            "v4.7.0",
            "v4.6.8",
            "v4.6.7",
            "v4.6.6",
            "v4.6.5",
            "v4.6.4",
            "v4.6.3",
            "v4.6.2",
            "v4.6.1",
            "v4.6.0",
            "v4.5.0",
            "v4.4.2",
            "v4.4.1",
            "v4.4.0",
            "v4.3.1",
            "v4.3.0",
            "v4.2.0",
            "v4.1.3",
            "v4.1.2",
            "v4.1.1",
            "v4.1.0",
            "v4.0.1",
            "v4.0.0",
            "v3.1.8",
            "v3.1.7",
            "v3.1.6",
            "v3.1.5",
            "v3.1.4",
            "v3.1.3",
            "v3.1.2",
            "v3.1.1",
            "v3.1.0",
            "v3.0.2",
            "v3.0.1",
            "v3.0.0",
            "v2.7.2",
            "v2.7.1",
            "v2.7.0",
            "v2.6.4",
            "v2.6.3",
            "v2.6.2",
            "v2.6.1",
            "v2.6.0",
            "v2.5.0",
            "v2.4.2",
            "v2.4.1",
            "v2.4.0",
            "v2.3.2",
            "v2.3.2-gpgtest.0",
            "v2.3.1",
            "v2.3.0",
            "v2.2.1",
            "v2.2.0",
            "v2.1.0",
            "v2.0.0",
            "v1.11.0",
            "v1.10.0",
            "v1.9.0",
            "v1.8.0",
            "v1.7.0",
            "v1.6.0",
            "v1.5.0",
            "v1.4.0",
            "v1.3.4",
            "v1.3.3",
            "v1.3.2",
            "v1.3.1",
            "v1.3.0",
            "v1.2.2",
            "v1.2.1",
            "v1.2.0",
            "v1.1.2",
            "v1.1.1",
            "v1.1.0",
            "v1.0.4",
            "v1.0.3",
            "v1.0.2",
            "v1.0.1",
            "v1.0.0",
            "v0.7.1",
            "v0.7.0",
            "v0.6.5",
            "v0.6.4",
            "v0.6.3",
            "v0.6.2",
            "v0.6.1",
            "v0.6.0",
            "v0.5.15",
            "v0.5.14",
            "v0.5.13",
            "v0.5.12",
            "v0.5.11",
            "v0.5.9",
            "v0.5.8",
            "v0.5.7",
            "v0.5.6",
            "v0.5.5",
            "v0.5.4",
            "v0.5.3",
            "v0.5.2",
            "v0.5.1",
            "v0.5.0",
            "v0.4.4",
            "v0.4.3",
            "v0.4.2",
            "v0.4.1",
            "v0.4.0",
            "v0.3.45",
            "v0.3.44",
            "v0.3.43",
            "v0.3.42",
            "v0.3.41",
            "v0.3.40",
            "v0.3.39",
            "v0.3.38",
            "v0.3.37",
            "v0.3.35",
            "v0.3.34",
            "v0.3.33",
            "v0.3.32",
            "v0.3.31",
            "v0.3.30",
            "v0.3.29",
            "v0.3.28",
            "v0.3.27",
            "v0.3.26",
            "v0.3.25",
            "v0.3.22",
            "v0.3.21",
            "v0.3.20",
            "v0.3.19",
            "v0.3.18",
            "v0.3.17",
            "v0.3.16",
            "v0.3.15",
            "v0.3.14",
            "v0.3.13",
            "v0.3.12",
            "v0.3.11",
            "v0.3.10",
            "v0.3.9",
            "v0.3.8",
            "v0.3.7",
            "v0.3.6",
            "v0.3.5",
            "v0.3.4",
            "v0.3.3",
            "v0.3.2",
            "v0.3.1",
            "v0.3.0",
            "v0.2.4",
            "v0.2.3",
            "v0.2.2",
            "v0.2.0",
            "v0.1.24",
            "v0.1.23",
            "v0.1.22",
            "v0.1.21",
            "v0.1.20",
            "v0.1.19",
            "v0.1.17",
            "v0.1.16",
            "v0.1.15",
            "v0.1.14",
            "v0.1.13",
            "v0.1.12",
            "v0.1.10",
            "v0.1.9",
            "v0.1.8",
            "v0.1.7",
            "v0.1.6",
            "v0.1.5",
            "v0.1.4",
            "v0.1.3",
            "v0.1.2",
            "v0.1.1",
            "v0.1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-13033.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:50.580411548Z",
      "provider": "osv",
      "references": [
        "https://access.redhat.com/downloads/content/package-browser/",
        "https://catalog.redhat.com/software/containers/",
        "https://access.redhat.com/errata/RHSA-2026:15979",
        "https://access.redhat.com/errata/RHSA-2026:3751",
        "https://access.redhat.com/security/cve/CVE-2025-13033",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/13xxx/CVE-2025-13033.json",
        "https://github.com/nodemailer/nodemailer/security/advisories/GHSA-mm7p-fcc7-pg87",
        "https://nvd.nist.gov/vuln/detail/CVE-2025-13033",
        "https://bugzilla.redhat.com/show_bug.cgi?id=2402179",
        "https://github.com/nodemailer/nodemailer/commit/1150d99fba77280df2cfb1885c43df23109a8626",
        "https://github.com/nodemailer/nodemailer"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-1286"
        ],
        "cna_assigner": "redhat",
        "unresolved_ranges": [
          {
            "extracted_events": [
              {
                "range": [
                  {
                    "fixed": "1777566546"
                  },
                  {
                    "fixed": "1772573159"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "InverseAffectedRanges"
              }
            ]
          }
        ],
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/13xxx/CVE-2025-13033.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2025-13033",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 519097,
  "published_at": "2025-11-14T19:37:08.224+00:00"
}