6.5Mittel
CVE-2026-92598Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass
Beschreibung
Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings that pass domain allow-list checks but are delivered to attacker-controlled domains via SMTP.
Schwachstellentyp (CWE):
CWE-436
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| nodemailer | nodemailer | < 9.1.0, fixed 9.1.0 |
Referenzen und Patches
- GitHub Security Advisory (GHSA-wmmp-3585-3rmp) vendor-advisory
- Patch Commit patch
- Patch Commit patch
- VulnCheck Advisory: Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass third-party-advisory