GHSA-m943-m63m-w62w
MediumSummary
addressparser ends an RFC 5322 group at the first `;`, even when it appears inside a quoted display name or a comment. The text after it is re-parsed as top-level recipients with quoting flipped, so text that a conformant parser reads as a display name or comment is misinterpreted.
Risk Assessment
An attacker can craft an email address that is misinterpreted, potentially bypassing validation or spoofing another sender.
Recommendation
Update addressparser to a patched version or replace it with an RFC 5322-compliant parser. Verify correct parsing of address groups in the application.
Other vulnerabilities in addressparser
See all- GHSA-v53p-9fqp-m79jHigh
When addressparser finds no address by its strict reading, it falls back to pulling one out of the free text with /\s*\b[^@\s]+@[^\s]+\b\s*/. That pattern backtracks quadratically, causing high resource consumption when processing a single header.
- GHSA-85x2-q946-cp5hMedium
The addressparser library ends angle-addr parsing at the first `>` it encounters, even when that character appears inside a quoted local part, a comment, or a domain literal. The domain is then read from the text preceding that `>`, resulting in incorrect email address interpretation.
- GHSA-8c8m-p3m8-cjg8Medium
RFC 5322 comments can be nested, but addressparser ends a comment at the first `)`, including the one closing a nested comment, and parses the remainder of the outer comment as header text. This leads to incorrect email address interpretation.
Original NVD description (English source)
### Vulnerability summary addressparser ends an RFC 5322 group at the first `;`, including one inside a quoted display name or a comment. The text after it is parsed again as top level recipients with the quoting flipped, so text that every conformant parser reads as a display name or comment becom
Vulnerability data from NVD (NIST) · CISA KEV · EPSS