{"record":{"id":"0a3df24aaf508d41","repo":"nextauthjs/next-auth","slug":"invalid-email-address-format","errorCode":null,"errorMessage":"Invalid email address format.","messagePattern":"Invalid email address format\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"packages/core/src/lib/actions/signin/send-token.ts","lineNumber":108,"sourceCode":"    })}`,\n  }\n}\n\nexport function defaultNormalizer(email?: string) {\n  if (!email) throw new Error(\"Missing email from request body.\")\n\n  // Apply Unicode NFKC normalization *before* validation. Without this, a\n  // character that is a homoglyph of `@` (e.g. U+FF20 FULLWIDTH COMMERCIAL AT)\n  // passes the single-`@` check below, but can later be canonicalized to an\n  // ASCII `@` by a downstream address parser, splitting the address into\n  // multiple recipients. Normalizing first ensures any such homoglyph is\n  // turned into a real `@` and rejected by the checks below.\n  const trimmedEmail = email.normalize(\"NFKC\").toLowerCase().trim()\n\n  // Reject email addresses with quotes to prevent address parser confusion\n  // This prevents attacks like \"attacker@evil.com\"@victim.com\n  if (trimmedEmail.includes('\"')) {\n    throw new Error(\"Invalid email address format.\")\n  }\n\n  // Get the first two elements only,\n  // separated by `@` from user input.\n  let [local, domain] = trimmedEmail.split(\"@\")\n\n  // Validate that we have exactly 2 parts (local and domain)\n  if (!local || !domain || trimmedEmail.split(\"@\").length !== 2) {\n    throw new Error(\"Invalid email address format.\")\n  }\n\n  // The part before \"@\" can contain a \",\"\n  // but we remove it on the domain part\n  domain = domain.split(\",\")[0]\n\n  // Additional validation: domain should not be empty after comma split\n  if (!domain) {\n    throw new Error(\"Invalid email address format.\")","sourceCodeStart":90,"sourceCodeEnd":126,"githubUrl":"https://github.com/nextauthjs/next-auth/blob/a1a16a5a7780488c7449feece410033f445d0b31/packages/core/src/lib/actions/signin/send-token.ts#L90-L126","documentation":"defaultNormalizer normalizes the submitted email with NFKC, lowercases and trims it, then applies sanity checks. Emails containing double quotes are rejected outright to prevent parser-confusion attacks such as \"attacker@evil.com\"@victim.com, producing 'Invalid email address format.'","triggerScenarios":"Submitting an email that contains a double-quote character anywhere in the string — the check `trimmedEmail.includes('\"')` rejects it before further validation.","commonSituations":"Users pasting quoted addresses copied from mail clients (display names with quotes); stored addresses in legacy systems using RFC 5322 quoted local parts; test inputs with quotes; injection attempts being correctly rejected.","solutions":["Strip quotes from user input before submitting, or show a validation error telling the user the address contains invalid characters","Use type=\"email\" and a client-side regex that disallows quotes to catch it before the request","If legitimate quoted local-parts must be supported, pre-normalize on your side or use a custom normalizer before calling the provider's send flow"],"exampleFix":"// before\nconst email = rawInput; // \"bob\"@example.com\n// after\nconst email = rawInput.replace(/\"/g, '').trim();\nif (!/^[^@\\s\"]+@[^@\\s\"]+$/.test(email)) throw new Error('Invalid email');","handlingStrategy":"validation","validationCode":"if (/^[^@\\s\"]+@[^@\\s\"]+$/.test(email) && !email.includes('\"')) {\n  await signIn('email', { email });\n}","typeGuard":"function isQuoteFreeEmail(v: string): boolean {\n  return !v.includes('\"') && /^[^@]+@[^@]+$/.test(v);\n}","tryCatchPattern":"try {\n  await signIn('email', { email });\n} catch (e) {\n  if (/Invalid email address format/.test(String(e))) {\n    // show 'please enter a valid email address' and sanitize quotes\n  }\n}","preventionTips":["Sanitize pasted input: strip quotes and display-name decorations before submit","Use type=\"email\" inputs to leverage browser validation","Never accept RFC 5322 quoted local parts in user-facing forms","Add a regex check rejecting quotes, spaces, and multiple @ before calling signIn"],"tags":["email","validation","security","input"],"backgroundTag":"email-validation-failed","analyzedSha":"a1a16a5a7780488c7449feece410033f445d0b31","analyzedAt":"2026-08-28T21:52:38.200Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}