CVE-2026-92598: Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass
Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings that pass domain allow-list checks but are delivered to attacker-controlled domains via SMTP.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nodemailerto a version that resolves this vulnerability.Fixed in 9.1.0Patch IDN/Punycode Domain Allow-list Bypass
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using Nodemailer before 9.1.0 are exposed if they rely on domain allow-list checks for recipient addresses and permit internationalized domain names. The bypass can cause a recipient that passes the application's allow-list validation to resolve to an attacker-controlled SMTP destination.
What does an attacker need to exploit the bypass?
An attacker needs to submit or influence a recipient email address accepted by the application. They must craft an internationalized domain containing invisible characters or compatibility mappings that produces different results between the allow-list check and SMTP domain resolution.
Are applications without recipient domain allow-lists affected in the same way?
The described impact specifically depends on a domain allow-list check being used before delivery. Without such a check, the stated allow-list bypass condition does not apply.
What should be done if an immediate upgrade is not possible?
Avoid relying on Nodemailer's pre-9.1.0 handling for allow-list decisions involving internationalized domains. Restrict recipient domains to validated ASCII domains or apply standards-compliant UTS-46 normalization consistently before comparing domains against the allow-list.