CVE-2026-92598

Name of the Vulnerable Software and Affected Versions Nodemailer versions prior to 9.1.0

Description Nodemailer fails to apply UTS-46 normalization when encoding international domain names (IDN), leading to a discrepancy between how the software and standards-compliant parsers (such as web browsers and Node's url.domainToASCII) compute Punycode A-labels. The issue resides in the normalizeAddress() function within lib/mime-node/index.js, which uses a raw RFC-3492 Punycode codec that lacks UTS-46 mapping and normalization. This allows attackers to use invisible characters, such as the U+00AD SOFT HYPHEN, or compatibility mappings to bypass domain allow-list checks. While a validator may see a trusted domain, Nodemailer delivers the email to a different, potentially attacker-controlled domain via SMTP. This occurs because the software does not perform essential UTS-46 steps, including removing ignored code points, mapping compatibility characters, and Unicode NFC normalization.

Recommendations Update Nodemailer to version 9.1.0 or later. As a temporary mitigation, reject any domain whose value changes when processed by a UTS-46 compliant mapper, such as when punycode.toASCII(d) does not equal url.domainToASCII(d).