CVE-2026-100699

Executive Summary

CVE-2026-100699 is an input validation vulnerability in Nodemailer, a widely used Node.js email-sending library. Versions 9.1.0 through 10.0.8 mishandle recipient addresses where a quoted local-part is followed by an RFC 5322 comment, allowing attacker-controlled domain text to be retained in the normalized address. This can cause the malformed address to be accepted into the SMTP envelope, potentially leading to unintended recipient delivery. The vulnerability has a CVSS score of 5.3 (Moderate) and no public proof-of-concept or exploit code is currently available.

Technical Analysis

The vulnerability resides in Nodemailer's address parser (src/addressparser) and affects the code path that processes addresses with a quoted local-part. According to the NVD description, when an address such as "user"@example.com(x)evil.com is parsed, the parser incorrectly retains the trailing comment-separated domain atoms. The resulting normalized address value becomes 'user@example.com evil.com' — a string containing two domain components separated by a literal space.

This parsed value is then used without further strict recipient validation when the message envelope is constructed (specifically in envelope.to within src/mime-node). Because the malformed address is accepted, it is placed directly into the SMTP envelope. The core issue is a failure to properly handle RFC 5322 comments when they appear after a quoted local-part and before additional domain atoms. This is a variant of a previously addressed comment parsing problem (GHSA-cc9r-2j5m-2m83) that affected a different code path. The vulnerability class is CWE-20 (Improper Input Validation), and the attack vector is network-based with low complexity and no privileges required.

Exploitation Scenarios

No public proof-of-concept or exploit code is available; the attack chain is inferred from the vulnerability class and the NVD description.

1. Reconnaissance/target identification: An attacker identifies a target application that uses Nodemailer (versions 9.1.0 to 10.0.8) to send emails, particularly where user-supplied input (such as a contact form, user registration email, or password reset address) is passed as the recipient address.
2. Triggering the flaw class: The attacker supplies a crafted email address containing a quoted local-part followed by an RFC 5322 comment and additional domain text. The specific payload format, as described in the NVD, is "user"@example.com(x)evil.com. The parser misinterprets this input, producing a normalized address that includes the extra domain text separated by a space.
3. Payload/execution method: The malformed address is accepted without strict validation and is incorporated into the SMTP envelope's to field. The application then attempts to send the email using this ambiguous recipient.
4. Post-exploitation impact: Whether this results in delivery to an unintended recipient on real SMTP servers has not been confirmed. If it does, an attacker could potentially redirect emails to an address they control, leading to information disclosure or spam relay. The CVSS vector indicates a low integrity impact only.

Impact Assessment

The CVSS v3.1 score is 5.3, reflecting a network attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N). The scope is unchanged (S:U), and there is no confidentiality (C:N) or availability (A:N) impact. The only impact is to integrity (I:L), as the email envelope may be constructed with an unintended recipient.

Business impact includes potential misdelivery of sensitive emails, brand damage if emails are sent to attacker-controlled addresses, and possible abuse for spam or phishing campaigns. The blast radius is limited to applications using affected Nodemailer versions that process untrusted input as recipient addresses. Because Nodemailer is a library, the actual exploitability depends on how the consuming application handles user-supplied email addresses.

Detection Guidance

Sigma Rule

title: Nodemailer Malformed Recipient Address Parsing Attempt
id: 8f1c2e3a-4b5d-6e7f-8a9b-0c1d2e3f4a5b
status: experimental
description: Detects attempts to exploit CVE-2026-100699 by submitting email addresses with quoted local-parts followed by comments and extra domain text.
author: Threat Intelligence
date: 2026-01-01
logsource:
  category: application
  product: nodemailer
detection:
  selection:
    event: "email_send_attempt"
    recipient_address|re: '^"[^"]+"@[^)]+\([^)]*\)[^@\s]+'
  condition: selection
falsepositives:
  - Legitimate email addresses with comments (rare)
level: medium
tags:
  - attack.t1190
  - cve.2026-100699

YARA Rule

rule CVE_2026_100699_Nodemailer_AddressParser
{
    meta:
        description = "Detects Nodemailer versions affected by CVE-2026-100699 via string patterns in package.json or source files"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100699"
        severity = "medium"
    strings:
        $version_9 = /"nodemailer"\s*:\s*"9\.1\.[0-9]+"/
        $version_10 = /"nodemailer"\s*:\s*"10\.0\.[0-8]"/
        $parser_path = "src/addressparser"
        $mime_node = "src/mime-node"
    condition:
        any of ($version_9, $version_10) or ($parser_path and $mime_node)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100699 Nodemailer Malformed Email Address Exploit Attempt"; flow:to_server,established; content:"POST"; http_method; content:"@"; http_client_body; pcre:"/\"[^\"]+\"@[^)]+\([^)]*\)[^\s@]+/R"; reference:cve,2026-100699; classtype:attempted-recon; sid:1000699; rev:1;)

Elastic Detection

process where event.action == "email_send" and process.name == "node" and
  wildcard(recipient.address, "\"*\"@*?*") and
  stringContains(recipient.address, ")")

Splunk SPL Query

index=app_logs sourcetype=nodemailer OR sourcetype=nodejs
| search "envelope.to" OR "recipient"
| regex recipient_address="^\"[^\"]+\"@[^)]+\([^)]*\)[^@\s]+"
| stats count by host, recipient_address, user
| where count > 0

Wazuh OSSEC Rule

<group name="nodemailer,cve-2026-100699,">
  <rule id="100699" level="10">
    <decoded_as>json</decoded_as>
    <field name="recipient_address">^\"[^\"]+\"@[^)]+\([^)]*\)[^@\s]+</field>
    <description>CVE-2026-100699: Nodemailer malformed recipient address detected - possible exploit attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_100699,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Upgrade Nodemailer to version 10.0.9 or later. The NVD description explicitly states that version 10.0.9 contains a fix.
   • If immediate upgrade is not possible, implement strict server-side validation of all email addresses before passing them to Nodemailer. Reject any address containing comments, multiple @ symbols, spaces, or unusual characters.
   • Sanitize and canonicalize all user-supplied email addresses using a well-tested email validation library that adheres strictly to RFC 5322 without comment support.

2. Patch/upgrade steps:

   • Run npm install nodemailer@10.0.9 or later in affected projects.
   • Verify the installed version with npm list nodemailer.
   • Rebuild and redeploy the application.

3. Long-term hardening:

   • Treat all user-supplied input as untrusted, especially when it flows into email headers or SMTP envelopes.
   • Adopt a defense-in-depth approach: validate, sanitize, and encode email addresses at multiple layers.
   • Monitor Nodemailer security advisories and GitHub Security Advisories for future updates.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100699
• GitHub Security Advisory (related variant): GHSA-cc9r-2j5m-2m83
• Nodemailer GitHub Repository: https://github.com/nodemailer/nodemailer
• RFC 5322 (Internet Message Format): https://datatracker.ietf.org/doc/html/rfc5322
• CWE-20 (Improper Input Validation): https://cwe.mitre.org/data/definitions/20.html

No known threat actor campaigns or exploit-in-the-wild evidence are currently associated with this CVE. CISA KEV status: NO.