High severity7.5OSV Advisory· Published Nov 14, 2025· Updated May 11, 2026
CVE-2025-13033
CVE-2025-13033
Description
A vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient email addresses. An attacker can exploit this flaw by crafting a recipient address that embeds an external address within quotes. This causes the application to misdirect the email to the attacker's external address instead of the intended internal recipient. This could lead to a significant data leak of sensitive information and allow an attacker to bypass security filters and access controls.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
nodemailernpm | < 7.0.7 | 7.0.7 |
Affected products
34- Range: v0.1, v0.1.1, v0.1.10, …
- osv-coords33 versionspkg:apk/chainguard/jitsucom-jitsupkg:apk/chainguard/jitsucom-jitsu-consolepkg:apk/chainguard/jitsucom-jitsu-rotorpkg:apk/chainguard/kibana-7pkg:apk/chainguard/kibana-7-bitnamipkg:apk/chainguard/kibana-8.17pkg:apk/chainguard/kibana-8.17-bitnamipkg:apk/chainguard/kibana-8.17-iamguardedpkg:apk/chainguard/kibana-8.18pkg:apk/chainguard/kibana-8.18-bitnamipkg:apk/chainguard/kibana-8.18-iamguardedpkg:apk/chainguard/kibana-8.19pkg:apk/chainguard/kibana-8.19-bitnamipkg:apk/chainguard/kibana-8.19-iamguardedpkg:apk/chainguard/kibana-9.0pkg:apk/chainguard/kibana-9.0-bitnamipkg:apk/chainguard/kibana-9.0-iamguardedpkg:apk/chainguard/kibana-9.1pkg:apk/chainguard/kibana-9.1-bitnamipkg:apk/chainguard/kibana-9.1-iamguardedpkg:apk/chainguard/langfusepkg:apk/chainguard/langfuse-compatpkg:apk/chainguard/langfuse-workerpkg:apk/chainguard/librechatpkg:apk/chainguard/librechat-compatpkg:apk/chainguard/librechat-devpkg:apk/wolfi/jitsucom-jitsupkg:apk/wolfi/jitsucom-jitsu-consolepkg:apk/wolfi/jitsucom-jitsu-rotorpkg:apk/wolfi/langfusepkg:apk/wolfi/langfuse-compatpkg:apk/wolfi/langfuse-workerpkg:npm/nodemailer
< 2.11.0-r4+ 32 more
- (no CPE)range: < 2.11.0-r4
- (no CPE)range: < 2.11.0-r4
- (no CPE)range: < 2.11.0-r4
- (no CPE)range: < 7.17.29-r5
- (no CPE)range: < 7.17.29-r5
- (no CPE)range: < 8.17.10-r2
- (no CPE)range: < 8.17.10-r2
- (no CPE)range: < 8.17.10-r2
- (no CPE)range: < 8.18.8-r1
- (no CPE)range: < 8.18.8-r1
- (no CPE)range: < 8.18.8-r1
- (no CPE)range: < 8.19.5-r1
- (no CPE)range: < 8.19.5-r1
- (no CPE)range: < 8.19.5-r1
- (no CPE)range: < 9.0.8-r1
- (no CPE)range: < 9.0.8-r1
- (no CPE)range: < 9.0.8-r1
- (no CPE)range: < 9.1.5-r1
- (no CPE)range: < 9.1.5-r1
- (no CPE)range: < 9.1.5-r1
- (no CPE)range: < 3.125.0-r0
- (no CPE)range: < 3.125.0-r0
- (no CPE)range: < 3.125.0-r0
- (no CPE)range: < 0.8.0-r1
- (no CPE)range: < 0.8.0-r1
- (no CPE)range: < 0.8.0-r1
- (no CPE)range: < 2.11.0-r4
- (no CPE)range: < 2.11.0-r4
- (no CPE)range: < 2.11.0-r4
- (no CPE)range: < 3.125.0-r0
- (no CPE)range: < 3.125.0-r0
- (no CPE)range: < 3.125.0-r0
- (no CPE)range: < 7.0.7
Patches
Vulnerability mechanics
References
8- github.com/advisories/GHSA-mm7p-fcc7-pg87ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-13033ghsaADVISORY
- access.redhat.com/security/cve/CVE-2025-13033nvdWEB
- bugzilla.redhat.com/show_bug.cginvdWEB
- github.com/nodemailer/nodemailer/commit/1150d99fba77280df2cfb1885c43df23109a8626nvdWEB
- github.com/nodemailer/nodemailer/security/advisories/GHSA-mm7p-fcc7-pg87nvdWEB
- access.redhat.com/errata/RHSA-2026:15979nvd
- access.redhat.com/errata/RHSA-2026:3751nvd
News mentions
0No linked articles in our index yet.