{"action":"Upgrade nodemailer to 10.0.9 or later.","affected":[{"fixed":"10.0.9","introduced":"9.1.0"}],"component":"nodemailer","cve_ids":["CVE-2026-100699"],"ecosystem":"npm","epss":0.00233,"exploited":false,"fixed_versions":["10.0.9"],"ghsa_id":"GHSA-g57g-f23g-4646","id":"tcs_01M5KFQ5DEZRZA019P2SPHQCQZ","modified_at":"2026-09-30T00:00:03.851424904Z","published_at":"2026-09-29T23:44:04Z","references":["https://osv.dev/vulnerability/GHSA-g57g-f23g-4646","https://github.com/nodemailer/nodemailer/security/advisories/GHSA-g57g-f23g-4646","https://github.com/nodemailer/nodemailer/commit/2f36eb1aa1dd33e312411dc9b888548e14db54ee","https://github.com/nodemailer/nodemailer","https://github.com/nodemailer/nodemailer/releases/tag/v10.0.9"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-g57g-f23g-4646","url":"https://osv.dev/vulnerability/GHSA-g57g-f23g-4646"}],"summary":"Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing"}