Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing

Summary

Nodemailer's address parser can produce an unexpected recipient address when an RFC 5322 comment follows the domain of an address whose local-part is a quoted string.

For example:

"user"@example.com(x)evil.com

is parsed as:

{
  address: "[email protected] evil.com",
  name: ""
}

The resulting address therefore contains additional attacker-controlled domain text separated by a literal space.

The parsed .address value is subsequently propagated into the SMTP envelope:

src/addressparser/index.ts
        ↓
recipient.address
        ↓
src/mime-node/index.ts
        ↓
envelope.to

The envelope construction uses the parsed address without another strict address validation step.

This appears to be a variant of the RFC 5322 comment parsing issue addressed by GHSA-cc9r-2j5m-2m83, but it follows a different parser path when the local-part is quoted.

Reproduction

Input:

"user"@example.com(x)evil.com

Observed parser output:

address: "[email protected] evil.com"
name: ""

A second example:

"a"@b.com(c)d.com(e)f.com

produces:

address: "[email protected] d.com f.com"
name: ""

For comparison, the corresponding unquoted form:

[email protected](x)evil.com

takes a different code path and is handled by the existing protection differently.

Technical Details

The issue is caused by different parsing behavior for quoted and unquoted local-parts.

The quoted-local-part variant allows the comment-separated trailing domain atoms to remain in the resulting .address value.

That value is then used when constructing the message envelope:

envelope.to = recipients.map(to => to.address as string)

No additional strict recipient validation is performed at this boundary.

Security Impact

The confirmed impact is that attacker-controlled comment content can result in a malformed/ambiguous recipient address being accepted by the parser and propagated into envelope.to.

The reporter did not confirm successful delivery to an unintended recipient through a real SMTP server using this exact quoted-local-part variant.