CVE-2026-92598 in Nodemailer
Summary
by MITRE • 09/17/2026
Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings that pass domain allow-list checks but are delivered to attacker-controlled domains via SMTP.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability in Nodemailer versions prior to 9.1.0 stems from a critical failure to implement Internationalized Domain Name (IDN) normalization according to the UTS-46 standard during the encoding process for email recipients. When an application uses Nodemailer to send emails, it often relies on domain allow-lists or validation logic to ensure that messages are only sent to trusted domains. However, because the library does not strictly apply Unicode Normalization Form C (NFC) and compatibility decomposition as mandated by UTS-46, it fails to correctly resolve certain international characters into their canonical Punycode A-label representations before comparison with allow-lists. This discrepancy creates a significant divergence between how Nodemailer processes domain names for SMTP delivery and how standard DNS resolvers or web browsers process them during validation checks.
This technical flaw allows attackers to exploit the inconsistency by crafting recipient addresses that contain invisible characters, zero-width joiners, or Unicode compatibility mappings. These specially crafted strings may appear identical to a trusted domain when viewed in a user interface or checked against an allow-list using standard string comparison methods. However, because Nodemailer does not normalize these inputs before encoding them for SMTP transmission, the underlying DNS resolution mechanism interprets the address differently. The resolver computes a different Punycode A-label than what was intended by the validation logic, effectively bypassing security controls that rely on exact domain matching. This results in emails being delivered to attacker-controlled domains rather than the legitimate recipients specified in the application code.
The operational impact of this vulnerability is severe, particularly for applications that implement email allow-lists as a primary defense against phishing or data exfiltration via SMTP. By bypassing these checks, an attacker can send malicious content, such as spear-phishing emails containing malware links or sensitive corporate information, to external domains without triggering security alerts. This undermines the integrity of communication channels and can lead to significant reputational damage, financial loss, and compromise of internal systems if recipients interact with the delivered payloads. The vulnerability is particularly dangerous because it exploits a subtle implementation detail rather than a gross logical error, making it difficult to detect through standard testing procedures that do not account for Unicode normalization edge cases.
From a classification perspective, this issue aligns with CWE-20 Improper Input Validation and CWE-749 Exposed Dangerous Method or Function, as the library fails to properly sanitize and validate input before processing. In terms of attack vectors, it relates to MITRE ATT&CK techniques involving Obfuscated Files or Information, where attackers use encoding schemes to evade detection mechanisms. To mitigate this risk, organizations using Nodemailer must upgrade immediately to version 9.1.0 or later, which corrects the normalization logic to ensure strict compliance with UTS-46 standards. Additionally, developers should implement additional layers of validation at the application level, such as canonicalizing domain names before allow-list checks and employing multi-factor authentication for critical email operations where possible. Regular security audits focusing on Unicode handling in input fields are also recommended to prevent similar bypasses in other components of the system.