p PatchFirst

CVE-2025-13033

CVE-2025-13033 · Nodemailer: nodemailer: email to an unintended domain can occur due to interpretation conflict

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient email addresses. An attacker can exploit this flaw by crafting a recipient address that embeds an external address within quotes. This causes the application to misdirect the email to the attacker's external address instead of the intended internal recipient. This could lead to a significant data leak of sensitive information and allow an attacker to bypass security filters and access controls.

CVSS 7.5 · High · EPSS 0.6% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • nodemailer

    Versions
    • ≥ 0, < 7.0.7: Affected (semver)

    Update to 7.0.7

  • red hat ceph storage 8.1

    Versions
    • ≥ 1777566546: Not affected (rpm)

    No fix published

  • red hat developer hub 1.9

    Versions
    • ≥ 1772573159: Not affected (rpm)

    No fix published

  • red hat advanced cluster management for kubernetes 2

    No fix published

  • node-nodemailer Debian:12

    Versions
    • 10.0.0+~8.0.1-1
    • 10.0.10+~8.0.1-1
    • 10.0.10+~8.0.2-1
    • 10.0.13+~8.0.2-1
    • 10.0.14+~8.0.2-1
    • 10.1.7+~8.0.2-1
    • 6.10.0+~6.4.17-1
    • 6.8.0+~6.4.6-1
    • 6.9.13+~6.4.14-1
    • 6.9.15+~6.4.16-1
    • 6.9.16+~6.4.16-1
    • 6.9.4+~6.4.9-1
    • 6.9.4+~6.4.9-2
    • 6.9.4+~6.4.9-3
    • 6.9.4+~6.4.9-4
    • 7.0.10+~7.0.2-1
    • 7.0.12+~7.0.5-1
    • 7.0.5+~7.0.1-1
    • 7.0.6+~7.0.1-1
    • 7.0.9+~7.0.2-1
    • 7.0.9+~7.0.2-2
    • 8.0.11+~8.0.1-1
    • 8.0.2+~7.0.11-1
    • 8.0.3+~7.0.11-1
    • 8.0.4+~7.0.11-1
    • 8.0.4+~7.0.11-2
    • 9.0.0+~8.0.1-1
    • 9.0.3+~8.0.1-1
    • 9.0.5+~8.0.1-1
    • 9.0.6+~8.0.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-nodemailer Debian:13

    Versions
    • 6.10.0+~6.4.17-1
    Affected ranges
    • ECOSYSTEM: < 6.10.0+~6.4.17-1+deb13u1

    Update to 6.10.0+~6.4.17-1+deb13u1

  • node-nodemailer Debian:14

    Versions
    • 6.10.0+~6.4.17-1
    • 7.0.5+~7.0.1-1
    • 7.0.6+~7.0.1-1
    Affected ranges
    • ECOSYSTEM: < 7.0.9+~7.0.2-1

    Update to 7.0.9+~7.0.2-1

  • nodemailer npm

    Affected ranges
    • SEMVER: < 7.0.7

    Update to 7.0.7

  • node-nodemailer Ubuntu:20.04:LTS

    Versions
    • 6.3.0-2
    • 6.3.1-1
    • 6.4.0-1
    • 6.4.1-1
    • 6.4.2-1
    • 6.4.5-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-nodemailer Ubuntu:22.04:LTS

    Versions
    • 6.4.17-3
    • 6.7.0-1
    • 6.7.0-2
    • 6.7.1+~6.4.4-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-nodemailer Ubuntu:24.04:LTS

    Versions
    • 6.9.4+~6.4.9-2
    • 6.9.4+~6.4.9-3ubuntu1
    • 6.9.4+~6.4.9-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-nodemailer Ubuntu:25.10

    Versions
    • 6.10.0+~6.4.17-1
    • 7.0.5+~7.0.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →