GHSA-g57g-f23g-4646: Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing

Nodemailer’s address parser can produce an unexpected recipient address when an RFC 5322 comment follows the domain of an address whose local-part is a quoted string.

For example:

"user"@example.com(x)evil.com

is parsed as:

{
address: "user@example.com evil.com",
name: ""
}

The resulting address therefore contains additional attacker-controlled domain text separated by a literal space.

The parsed .address value is subsequently propagated into the SMTP envelope:

src/addressparser/index.ts
↓
recipient.address
↓
src/mime-node/index.ts
↓
envelope.to

The envelope construction uses the parsed address without another strict address validation step.

This appears to be a variant of the RFC 5322 comment parsing issue addressed by GHSA-cc9r-2j5m-2m83, but it follows a different parser path when the local-part is quoted.