High severity · published Nov 14, 2025
CVE-2025-13033
Nodemailer: nodemailer: email to an unintended domain can occur due to interpretation conflict
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
A vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient email addresses. An attacker can exploit this flaw by crafting a recipient address that embeds an external address within quotes. This causes the application to misdirect the email to the attacker's external address instead of the intended internal recipient. This could lead to a significant data leak of sensitive information and allow an attacker to bypass security filters and access controls.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat Advanced Cluster Management for Kubernetes 2 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Ceph Storage 8.1 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Developer Hub 1.9 · Red Hat
All versions, or not specified · source: vendor
NO
nodemailer · nodemailer
before 7.0.7 · source: vendor
Affected product
NO
nodemailer
nodemailer
More from nodemailer
9.8
CVE-2026-82854
Nodemailer before 8.0.3 SMTP Command Injection via envelope.size
9.8
CVE-2020-7769
This affects the package nodemailer before 6.4.16
8.8
CVE-2021-23400
The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address…
7.5
CVE-2026-110869
Nodemailer 3.0.0 before 10.0.13 ReDoS via SMTP AUTH Mechanism Detection Regexes
7.5
CVE-2026-100700
nodemailer before 10.0.6 Denial of Service via addressparser