CVE-2026-92597: Nodemailer before 9.1.0 Email Domain Validation Bypass via RFC 5322 Comment
Nodemailer versions >= 6.9.16 and < 9.1.0 mis-parse RFC 5322 comments in email addresses: in lib/addressparser, a comment closed immediately before a non-break character causes the tokenizer to concatenate the atoms surrounding the comment instead of treating the comment as folding whitespace that terminates the domain. A recipient address such as user@good-corp.com(x)evil.com is therefore read by Nodemailer as the single domain good-corp.comevil.com (registrable domain comevil.com, which an attacker can register) and used for both the SMTP envelope (RCPT TO) and the emitted To:/From: headers, while a conformant RFC 5322 parser terminates the domain at the comment and reads good-corp.com. An application that validates the recipient domain with a strict RFC 5322 parser (without inspecting parse defects) or a naive prefix/substring allow-list and then hands the raw address to Nodemailer can be induced to deliver mail to a domain the attacker controls. Fixed in 9.1.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nodemailerto a version that resolves this vulnerability.Fixed in 9.1.0
Event History
Frequently Asked Questions
Which applications are realistically exposed?
Applications are exposed when they accept recipient addresses from an attacker, validate the domain using a strict RFC 5322 parser without checking parse defects or a naive prefix/substring allow-list, and then pass the original raw address to Nodemailer.
What does an attacker need to exploit this?
The attacker needs to submit a specially formed address containing an RFC 5322 comment immediately before additional domain text, such as user@good-corp.com(x)evil.com. They also need control of the resulting domain Nodemailer constructs, such as the registrable domain comevil.com in the example.
How can I determine whether my Nodemailer deployment is affected?
Versions from 6.9.16 up to, but not including, 9.1.0 are affected. Version 9.1.0 fixes the parsing issue.
What is the practical consequence of a successful bypass?
Nodemailer can use the attacker-controlled concatenated domain for both the SMTP RCPT TO envelope recipient and the emitted To: or From: headers, even though a conformant parser would treat the allowed domain as the address domain.