6.5Medium
CVE-2026-92598Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass
Description
Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings that pass domain allow-list checks but are delivered to attacker-controlled domains via SMTP.
Weakness (CWE):
CWE-436
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| nodemailer | nodemailer | < 9.1.0, fixed 9.1.0 |
References and patches
- GitHub Security Advisory (GHSA-wmmp-3585-3rmp) vendor-advisory
- Patch Commit patch
- Patch Commit patch
- VulnCheck Advisory: Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass third-party-advisory