CVE-2026-100699 Overview
CVE-2026-100699 is an input validation flaw [CWE-20] in Nodemailer, a widely used Node.js email-sending library. The vulnerability affects versions >= 9.1.0 and < 10.0.9. The address parser located in src/addressparser mishandles email addresses whose local-part is a quoted string followed by RFC 5322 comments. Attacker-controlled domain atoms separated by a literal space can be retained in the normalized address and propagated into the SMTP envelope through envelope.to in src/mime-node. Version 10.0.9 contains the fix.
Critical Impact
Malformed recipient addresses can bypass validation and reach the SMTP envelope, potentially enabling delivery to attacker-controlled domains depending on receiving SMTP server behavior.
Affected Products
- Nodemailer versions >= 9.1.0
- Nodemailer versions < 10.0.9
- Node.js applications integrating the affected addressparser code path
Discovery Timeline
- 2026-09-26 - CVE-2026-100699 published to NVD
- 2026-09-30 - Last updated in NVD database
Technical Details for CVE-2026-100699
Vulnerability Analysis
The flaw resides in the address parsing logic that normalizes RFC 5322 email addresses before they are passed to the SMTP envelope builder. When the local-part of an address is quoted and followed by one or more RFC 5322 comments, the parser fails to strip subsequent domain atoms. Instead, it concatenates the trailing text into the normalized address value. For example, the input "user"@example.com(x)evil.com is parsed into user@example.com evil.com, a single string containing two domain tokens separated by a space.
Because this value is used without further strict recipient validation in src/mime-node when the message envelope is constructed, the malformed recipient reaches envelope.to. The downstream behavior depends on how the receiving SMTP server interprets ambiguous recipient data. Impact on real-world delivery has not been confirmed by the advisory.
Root Cause
The root cause is improper handling of RFC 5322 comments on the quoted-local-part code path within src/addressparser. This is a variant of the earlier RFC 5322 comment parsing issue tracked under GHSA-cc9r-2j5m-2m83, which did not cover the quoted local-part branch. Classification is CWE-20 (Improper Input Validation).
Attack Vector
An attacker supplies a crafted recipient address to an application that forwards user-controlled addresses into Nodemailer without additional validation. Common exposures include contact forms, account registration flows, invitation systems, and transactional email endpoints. No authentication or user interaction is required to submit the malformed address if the application exposes an unauthenticated email endpoint.
No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-g57g-f23g-4646 and the VulnCheck Advisory for details.
Detection Methods for CVE-2026-100699
Indicators of Compromise
- SMTP envelope RCPT TO entries containing whitespace-separated domain tokens or multiple @ characters.
- Outbound mail logs showing recipient addresses with embedded RFC 5322 comments such as (x) adjacent to domain atoms.
- Application logs recording Nodemailer sendMail calls where the to field includes quoted local-parts followed by parenthetical text.
Detection Strategies
- Inspect SMTP server logs for recipients whose normalized address contains a literal space between two domain-like tokens.
- Add regex-based validation on inbound form fields to reject addresses containing ( or ) outside of properly escaped quoted segments.
- Audit Nodemailer dependency versions across repositories using npm ls nodemailer and flag any installation in the vulnerable range.
Monitoring Recommendations
- Enable verbose SMTP transaction logging on outbound mail gateways to capture envelope-vs-header mismatches.
- Alert when transactional email services emit messages to recipient domains not on an approved allowlist.
- Track dependency drift with software composition analysis tooling to detect regressions below Nodemailer 10.0.9.
How to Mitigate CVE-2026-100699
Immediate Actions Required
- Upgrade Nodemailer to version 10.0.9 or later across all production and build environments.
- Audit application code that accepts user-supplied email addresses and enforce strict recipient validation before invoking transporter.sendMail.
- Review outbound mail logs for the past 30 days to identify suspicious recipient patterns consistent with this parsing flaw.
Patch Information
The maintainers released Nodemailer 10.0.9 with a corrected address parser that properly handles RFC 5322 comments following quoted local-parts. Upgrade using npm install nodemailer@^10.0.9 or the equivalent command for your package manager. See the GitHub Security Advisory GHSA-g57g-f23g-4646 for the fix commit and release notes.
Workarounds
- Validate recipient addresses with a strict parser such as the WHATWG email validation ruleset before passing them to Nodemailer.
- Reject any recipient value containing parentheses, embedded whitespace, or more than one @ symbol prior to envelope construction.
- Constrain outbound recipients to an allowlist of trusted domains for transactional email flows where feasible.
# Upgrade Nodemailer to the patched release
npm install nodemailer@^10.0.9
npm ls nodemailer
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
