CVE-2026-92597

Name of the Vulnerable Software and Affected Versions Nodemailer versions 6.9.16 through 9.0.x

Description Nodemailer mis-parses RFC 5322 comments within email addresses. In the lib/addressparser component, when a comment is closed immediately before a non-break character, the tokenizer concatenates the surrounding atoms instead of treating the comment as folding whitespace (CFWS) that should terminate the domain. For example, an address like user@good-corp.com(x)evil.com is interpreted as good-corp.comevil.com rather than good-corp.com.

This creates an interpretation conflict where an application using a strict RFC 5322 parser or a naive prefix/substring allow-list for domain validation may be deceived into believing an address is legitimate, while Nodemailer delivers the email to an attacker-controlled domain. This affects both the SMTP envelope RCPT TO and the To:/From: headers. The root cause is located in the handleAddress function and the tokenizer's handling of the noBreak property in lib/addressparser/index.js.

Recommendations Update Nodemailer to version 9.1.0 or later. As a temporary mitigation, avoid using naive prefix or substring allow-lists for email domain validation and ensure that any strict RFC 5322 parser used for validation is configured to inspect and reject parse defects.