CVE-2026-92598

Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding internationalized domain names, causing its domain resolver to compute a Punycode A-label that differs from what standards-compliant parsers compute for the same address. An attacker can craft recipient email addresses containing invisible characters or Unicode compatibility mappings that pass the application's domain allow-list check, while SMTP delivery resolves to a different, attacker-controlled domain. Successful exploitation redirects mail to attacker domains, potentially leaking message contents and confidential data (high confidentiality impact per the CVSS score). Any Node.js application using a vulnerable Nodemailer version with allow-lists that restrict recipient domains to trusted domains is affected. No public proof-of-concept is known and the issue is not listed in CISA KEV, so exploitation has not been confirmed in the wild.

What to do: Upgrade to Nodemailer 9.1.0 or later, which applies UTS-46 normalization before Punycode encoding. As an interim mitigation, normalize recipient domains (UTS-46, then convert to A-labels) with a standards-compliant library before evaluating them against allow-lists, or restrict recipients to ASCII-only domains. Review mail logs for recipient domains containing 'xn--' punycode labels or unexpected domains that differ from the allow-listed values.