CVE-2025-13033: Nodemailer: nodemailer: email to an unintended domain can occur due to interpretation conflict

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-11-14 · updated 2026-10-18
Weakness: CWE-1286

Description

A vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient email addresses. An attacker can exploit this flaw by crafting a recipient address that embeds an external address within quotes. This causes the application to misdirect the email to the attacker's external address instead of the intended internal recipient. This could lead to a significant data leak of sensitive information and allow an attacker to bypass security filters and access controls.

Affected products

nodemailer: before 7.0.7 — fixed in 7.0.7
Red Hat Advanced Cluster Management for Kubernetes 2: all versions
Red Hat Ceph Storage 8.1: all versions — fixed in 1777566546
Red Hat Developer Hub 1.9: all versions — fixed in 1772573159

How to fix

Upgrade to a fixed version: nodemailer 7.0.7; Red Hat Ceph Storage 8.1 1777566546; Red Hat Developer Hub 1.9 1772573159. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-13033 or the next vulnerability affects your stack