Vulnerability in Nodemailer
CVE-2025-13033
A vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient email addresses. An attacker can exploit this flaw by crafting a recipient address that embeds an external address within quotes. This causes the application to misdirect the email to the attacker's external address instead of the intended internal recipient. This could lead to a significant data leak of sensitive information and allow an attacker to bypass security filters and access controls.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.005 (42.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 43rd percentile — 42.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000
Affected products
- Nodemailer — versions 0
- Red Hat Advanced Cluster Management For Kubernetes 2
- Red Hat Ceph Storage 8
- Red Hat Ceph Storage 8.1 — versions 1777566546
- Red Hat Developer Hub 1.9 — versions 1772573159, sha256:141aeba778033153ed7005785565c8f3a00f6353be7bb3fd9124d8ad9375d988
Weakness classification (CWE)
References
- access.redhat.com/errata/RHSA-2026:3751 (vendor-advisory)
- access.redhat.com/security/cve/CVE-2025-13033 (vdb-entry)
- bugzilla.redhat.com/show_bug.cgi (issue-tracking)
- github.com/nodemailer/nodemailer
- github.com/nodemailer/nodemailer/commit/1150d99fba77280df2cfb1885c43df23109a8626
- github.com/nodemailer/nodemailer/security/advisories/GHSA-mm7p-fcc7-pg87
- access.redhat.com/errata/RHSA-2026:15979 (vendor-advisory)
Frequently asked questions
- What is CVE-2025-13033?
- CVE-2025-13033 is a high-severity vulnerability in Nodemailer, classified under CWE-1286. CVSS score: 7.5/10. Published 2025-11-14.
- How severe is CVE-2025-13033?
- High severity. CVSS v3 base score is 7.5 out of 10.