Nodemailer from version 3.0.0 up to 10.0.12 contains an input validation flaw in its address parser. The parser fails to remove RFC 5322 comments that are placed inside angle‑bracket email addresses. As a result, characters that are not normally allowed can reach the envelope.to field and the SMTP RCPT TO command, which may cause delivery failures or misinterpretation of the address during email processing. This behavior can also allow an attacker to bypass domain allow‑lists that rely on strict address matching.

The vulnerability affects the Nodemailer library from version 3.0.0, through 10.0.12. System administrators using the Nodemailer package in these releases, particularly when sending email through custom or third‑party SMTP services, are exposed to this flaw.

The CVSS score of 6.9 indicates a medium‑severity risk. The Exploit Prediction Scoring System is not available, and the vulnerability is not currently listed in CISA's KEV catalog. The absolute likelihood of exploitation is uncertain; however, the flaw can be triggered by providing a specially crafted recipient address in an email. If the mail server blocks the malformed address, legitimate deliveries may be rejected, or if the server accepts it, domain allow‑lists can be circumvented, potentially allowing spam or phishing emails to bypass filtering controls.