6.5Orta
CVE-2026-92598Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass
Açıklama
Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings that pass domain allow-list checks but are delivered to attacker-controlled domains via SMTP.
Zayıflık türü (CWE):
CWE-436
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| nodemailer | nodemailer | < 9.1.0, fixed 9.1.0 |
Kaynaklar ve yamalar
- GitHub Security Advisory (GHSA-wmmp-3585-3rmp) vendor-advisory
- Patch Commit patch
- Patch Commit patch
- VulnCheck Advisory: Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass third-party-advisory