CVE-2026-92597

Nodemailer versions 6.9.16 through 9.0.x contain a flaw in lib/addressparser where a comment closed immediately before a non-break character is not treated as folding whitespace that terminates the domain; instead, the tokenizer concatenates the atoms around the comment into a single domain. An attacker who submits an address such as [email protected](x)evil.com gets Nodemailer to read the recipient domain as good-corp.comevil.com (registrable domain comevil.com, which the attacker can register) and use it for both the SMTP envelope and the To:/From: headers, while a conformant RFC 5322 validator reads good-corp.com. Applications that allow-list recipient domains with a strict parser or naive prefix/substring check and then hand the raw address string to Nodemailer can therefore be tricked into sending mail to an attacker-controlled domain, potentially leaking message contents or enabling interception via the attacker's mail server. Any application or service in the affected version range that performs domain validation with a parser other than Nodemailer's own is affected; exploitation requires no privileges or user interaction. There is currently no CISA KEV listing and no known public proof-of-concept or reported in-the-wild exploitation.

What to do: Upgrade to Nodemailer 9.1.0 or later, which correctly terminates the domain at comments. Until upgraded, reject or strip addresses containing parenthesized comments before validation, or perform your domain allow-list check on the address as parsed by Nodemailer itself rather than with a separate strict parser or substring match, and audit outbound mail flows that accept user-supplied recipient addresses.