CVE-2026-100699: 
Grafana vulnerability analysis and mitigation

CVE-2026-100699 is an improper input validation vulnerability in Nodemailer, a popular Node.js email-sending library, that allows an attacker to inject malformed domain text into SMTP envelope recipient addresses via crafted RFC 5322 comments following a quoted local-part. It affects Nodemailer versions >= 9.1.0 and < 10.0.9, and was published on September 26, 2026. The vulnerability is a variant of the previously addressed GHSA-cc9r-2j5m-2m83, targeting a separate quoted-local-part parser code path. It carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory GHSA-g57g-f23g-4646, Red Hat Bugzilla).

The root cause is improper validation of syntactic correctness of input (CWE-1286) and improper input validation (CWE-20) in Nodemailer's address parser (src/addressparser/index.ts). When an email address has a quoted local-part (e.g., "user"@example.com) followed by an RFC 5322 comment containing additional domain atoms (e.g., (x)evil.com), the parser incorrectly retains the comment-separated trailing domain text in the normalized address, producing output such as user@example.com evil.com. This malformed address value is then propagated through recipient.address into envelope.to in src/mime-node/index.ts without any additional strict recipient validation, allowing attacker-controlled content to appear in the SMTP envelope. The unquoted local-part variant (user@example.com(x)evil.com) follows a different code path and was already addressed by the prior fix (GitHub Advisory GHSA-g57g-f23g-4646).

The primary confirmed impact is an integrity issue: attacker-controlled domain text can be injected into the SMTP envelope's recipient field (envelope.to), resulting in a malformed or ambiguous recipient address being accepted by Nodemailer without error. Whether this leads to actual email delivery to an unintended recipient depends on how downstream SMTP servers interpret the malformed address, which has not been confirmed as of the advisory's publication. There is no confirmed confidentiality or availability impact, and no evidence of lateral movement potential; the risk is primarily limited to potential email misdirection or recipient validation bypass in applications relying on Nodemailer for email delivery (GitHub Advisory GHSA-g57g-f23g-4646, Red Hat Bugzilla).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-100699. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires no authentication or user interaction, but the actual downstream impact (email misdirection) depends on SMTP server behavior and has not been confirmed end-to-end (GitHub Advisory GHSA-g57g-f23g-4646, GitHub Advisory Database).

1. Identify a target application: Find a web application or service that uses Nodemailer versions >= 9.1.0 and < 10.0.9 to send emails, where user-supplied or attacker-influenced data can be used as a recipient email address.
2. Craft a malicious address: Construct an email address with a quoted local-part followed by an RFC 5322 comment containing an additional domain, e.g., "user"@example.com(x)evil.com or "a"@b.com(c)d.com(e)f.com.
3. Submit the crafted address: Supply the malformed address as the recipient in any application input that is passed to Nodemailer's sendMail() or equivalent function (e.g., a contact form, registration email, or notification trigger).
4. Observe parser output: Nodemailer's address parser normalizes the input to user@example.com evil.com, retaining the attacker-controlled domain text, and propagates this value into envelope.to without further validation.
5. Assess SMTP server behavior: The malformed envelope recipient is submitted to the configured SMTP server; whether the server delivers to an unintended recipient or rejects the address depends on the specific SMTP implementation (GitHub Advisory GHSA-g57g-f23g-4646).

• Logs: Application logs showing email send attempts with recipient addresses containing spaces or multiple domain segments (e.g., user@example.com evil.com); SMTP server logs recording envelope RCPT TO commands with malformed or space-separated addresses.
• Network: Outbound SMTP connections where the RCPT TO field contains unexpected domain atoms or space-separated values not matching the intended recipient format.
• Application: Nodemailer debug output (if enabled) showing parsed address objects with .address values containing spaces between domain segments, indicating RFC 5322 comment injection.

The fix is available in Nodemailer version 10.0.9, which corrects the address parser to consistently reject or properly terminate addresses containing trailing domain atoms after RFC 5322 comments, regardless of whether the local-part is quoted. Users should upgrade to version 10.0.9 or later as the primary remediation. As a defense-in-depth measure, applications should independently validate recipient email addresses before passing them to Nodemailer, rejecting any input containing RFC 5322 comment syntax (parentheses) or unexpected characters (GitHub Advisory GHSA-g57g-f23g-4646, Red Hat Bugzilla).

The vulnerability was reported by researcher ZeroXJacks and published by Nodemailer maintainer andris9 as a moderate-severity advisory on September 12, 2026. The advisory explicitly notes that end-to-end SMTP delivery to an unintended recipient has not been confirmed, and the maintainer intentionally separated confirmed parser behavior from unconfirmed downstream SMTP impact to allow accurate severity assessment. Red Hat tracked the issue via Bugzilla with a medium priority/severity rating (GitHub Advisory GHSA-g57g-f23g-4646, Red Hat Bugzilla).