CVE-2026-92597 in Nodemailer
Summary
by MITRE • 09/17/2026
Nodemailer versions >= 6.9.16 and < 9.1.0 mis-parse RFC 5322 comments in email addresses: in lib/addressparser, a comment closed immediately before a non-break character causes the tokenizer to concatenate the atoms surrounding the comment instead of treating the comment as folding whitespace that terminates the domain. A recipient address such as [email protected](x)evil.com is therefore read by Nodemailer as the single domain good-corp.comevil.com (registrable domain comevil.com, which an attacker can register) and used for both the SMTP envelope (RCPT TO) and the emitted To:/From: headers, while a conformant RFC 5322 parser terminates the domain at the comment and reads good-corp.com. An application that validates the recipient domain with a strict RFC 5322 parser (without inspecting parse defects) or a naive prefix/substring allow-list and then hands the raw address to Nodemailer can be induced to deliver mail to a domain the attacker controls. Fixed in 9.1.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in versions of Nodemailer greater than or equal to 6.9.16 but less than 9.1.0 represents a critical email address parsing flaw rooted in non-compliance with RFC 5322 standards regarding the handling of comments within email addresses. The core technical defect resides in the lib/addressparser module, where the tokenizer fails to correctly interpret the boundary between an email domain and embedded comments when specific character sequences are present. Specifically, if a comment is closed immediately before a non-break character, such as a hyphen or alphanumeric character that continues without whitespace, the parser erroneously concatenates the atoms surrounding the comment rather than treating the closing parenthesis of the comment as a delimiter that terminates the current domain segment. This behavior deviates significantly from standard RFC 5322 parsing logic, which dictates that comments are ignored and do not alter the structural boundaries of address tokens unless they contain folding whitespace or specific delimiters defined by the protocol.
This misparsing leads to severe operational impacts related to email delivery manipulation and potential phishing attacks. When an attacker supplies a crafted recipient address such as [email protected](x)evil.com, Nodemailer interprets this string not as two distinct domains separated by a comment, but as a single malformed domain good-corp.comevil.com. Because the hyphen connects the end of the first domain to the start of the second without whitespace, the parser merges them into one continuous string. The resulting registrable domain is comevil.com, which an attacker can easily register and control. Consequently, Nodemailer uses this manipulated address for both the SMTP envelope recipient field (RCPT TO) and the emitted To or From headers in the email message itself. This means that while a human reader might see good-corp.com in the header due to how some clients render comments, the actual mail server delivers the message to comevil.com under the attacker's control.
The security implications are particularly acute for applications that implement domain validation prior to passing addresses to Nodemailer. If an application validates the recipient domain using a strict RFC 5322 parser or a naive prefix-based allow-list, it may correctly identify good-corp.com as valid and safe. However, because these validators often do not inspect parse defects or simulate how downstream libraries will interpret the raw string, they fail to detect that Nodemailer will subsequently misinterpret the address. This creates a validation bypass scenario where an attacker can trick legitimate applications into sending emails to malicious domains while maintaining the appearance of legitimacy in email headers. Such behavior facilitates phishing campaigns, business email compromise attacks, and reputation damage for the originating organization, as recipients may trust messages appearing to originate from or be addressed to trusted entities like good-corp.com.
To mitigate this vulnerability, organizations must immediately upgrade Nodemailer to version 9.1.0 or later, where the parsing logic has been corrected to adhere strictly to RFC 5322 specifications regarding comment handling and domain boundaries. For applications unable to update immediately, defensive coding practices should be implemented to sanitize email addresses before passing them to any mail transport agent. This includes stripping all comments from email addresses prior to validation or delivery, ensuring that only the local part and domain are processed without embedded parentheses or whitespace variations that could trigger parsing ambiguities. Additionally, developers should avoid relying solely on header rendering for security decisions and instead enforce strict domain allow-lists at the SMTP envelope level using a parser that matches the behavior of the mail transport agent being used. This vulnerability is categorized under CWE-20 Improper Input Validation as it stems from inadequate sanitization of user-supplied input, and aligns with ATT&CK techniques related to email delivery manipulation such as T1534 Internal Spearphishing or T1566 Phishing, where attackers exploit trust in communication channels.