CVE-2025-13033 Nodemailer: nodemailer: email to an unintended domain can occur due to interpretation conflict
Attackers can misdirect emails to external addresses by crafting specific recipient formats, leading to data leaks and bypassing security filters.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-13033?
CVE-2025-13033 is a high-severity vulnerability in Red Hat Advanced Cluster Management for Kubernetes 2, published on 14 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient email addresses. An attacker can exploit this flaw by crafting a recipient address that embeds an external address within quotes. This causes the application to misdirect the email to the attacker's external address instead of the intended internal recipient. This could lead to a significant data leak of sensitive information and allow an attacker to bypass security filters and access controls.
Weakness: CWE-1286
Which versions are affected by CVE-2025-13033?
2 open source packages ship an affected version, including nodemailer.
| Package | Affected | Fixed in |
|---|---|---|
nodemailer npm | All versions | 7.0.7 |
nodemailer npm | All versions | 7.0.7 |
How do I fix CVE-2025-13033?
Upgrade nodemailer to 7.0.7 or later.
Is CVE-2025-13033 being exploited?
There is no known exploitation of CVE-2025-13033 in the wild and no public exploit code.
Sources
Also known as CLSA-2026-1775003162, DEBIAN-CVE-2025-13033, ECHO-23af-6658-b0f8, GHSA-mm7p-fcc7-pg87, MINI-333q-78w5-2p5w, MINI-497r-37f3-37ph and 7 more.