Read the docs
TI-2025-11930 Aliases CVE-2025-13033GHSA-mm7p-fcc7-pg87

Nodemailer: nodemailer: email to an unintended domain can occur due to interpretation conflict

Priority MEDIUM 40CWE-1286Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 2 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

A vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient email addresses. An attacker can exploit this flaw by crafting a recipient address that embeds an external address within quotes. This causes the application to misdirect the email to the attacker's external address instead of the intended internal recipient. This could lead to a significant data leak of sensitive information and allow an attacker to bypass security filters and access controls.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00575 47th percentileScored 2026-11-07
Fix Partial nodemailer (nodemailer): 7.0.7nodemailer (npm): 7.0.7Red Hat: 2 advisoriesRed Hat: 2 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nodemailernodemailerbefore 7.0.77.0.7Patch availableCNA
Red HatRed Hat Ceph Storage 8.1—1777566546Patch availableCNA
Red HatRed Hat Developer Hub 1.9—1772573159Patch availableCNA
Red HatRed Hat Advanced Cluster Management for Kubernetes 2——No fix listedCNA
—nodemailer (npm)before 7.0.77.0.7Patch availableGHSA-mm7p-fcc7-pg87
  • nodemailer Vendornodemailer Affected before 7.0.7 Fixed in 7.0.7 Patch available CNA
  • Red Hat Ceph Storage 8.1 VendorRed Hat Affected — Fixed in 1777566546 Patch available CNA
  • Red Hat Developer Hub 1.9 VendorRed Hat Affected — Fixed in 1772573159 Patch available CNA
  • Red Hat Advanced Cluster Management for Kubernetes 2 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • nodemailer (npm) Vendor— Affected before 7.0.7 Fixed in 7.0.7 Patch available GHSA-mm7p-fcc7-pg87

CPE names CNA · 3

CPEVersionsRoleVendor
cpe:/a:redhat:ceph_storage:8.1::el98.1—Red Hat
cpe:/a:redhat:rhdh:1.9::el91.9—Red Hat
cpe:/a:redhat:acm:22—Red Hat
  • cpe:/a:redhat:ceph_storage:8.1::el9 Versions 8.1 — ·Red Hat
  • cpe:/a:redhat:rhdh:1.9::el9 Versions 1.9 — ·Red Hat
  • cpe:/a:redhat:acm:2 Versions 2 — ·Red Hat

Remediation

  • Fix · CNA nodemailer (nodemailer) Fixed in 7.0.7
  • Fix · GHSA-mm7p-fcc7-pg87 nodemailer (npm) Fixed in 7.0.7 Advisory →

Red Hat 2 advisories

  • RHSA-2026:15979 Released 2026-05-11 · Red Hat rating Important
    Red Hat Ceph Storage
    • Red Hat Ceph Storage 8.1 registry.redhat.io/rhceph/grafana-rhel9
  • RHSA-2026:3751 Released 2026-03-04 · Red Hat rating Moderate
    Red Hat Developer Hub 1.9.0 release.
    • Red Hat Developer Hub 1.9 registry.redhat.io/rhdh/rhdh-hub-rhel9

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat Ceph Storage 8.1Fixed RHSA-2026:15979
Red Hat Developer Hub 1.9Fixed RHSA-2026:3751
Not affected: 2 products
  • Red Hat Ceph Storage 8.1
  • Red Hat Developer Hub 1.9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-13033
  2. 2026-10-03 Alias added: GHSA-mm7p-fcc7-pg87

References

Advisory 3

Other 5

  • TI-2026-74559 ReDoS in Nodemailer SMTP AUTH mechanism detection regexes CVSS 4.0HIGH 8.7
  • TI-2026-64856 nodemailer before 10.0.6 Denial of Service via addressparser CVSS 4.0HIGH 8.7
  • TI-2026-62452 Nodemailer before 9.1.0 Denial of Service via addressparser CVSS 4.0HIGH 8.7
  • TI-2026-61683 Nodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsing CVSS 4.0HIGH 8.7
  • TI-2025-13566 Nodemailer: nodemailer: denial of service via crafted email address header CVSS 3.1HIGH 7.5
  • TI-2026-74560 Nodemailer address parser passes illegal characters to SMTP envelope CVSS 4.0MEDIUM 6.9
See all 27 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences