CVE-2026-92597: Nodemailer Email Domain Parsing Vulnerability

CVE-2026-92597 Overview

CVE-2026-92597 is an input validation flaw in Nodemailer, a widely used Node.js library for sending email over SMTP. The lib/addressparser module mis-parses RFC 5322 comments embedded in email addresses. A comment closed immediately before a non-break character causes the tokenizer to concatenate the atoms surrounding the comment. An address such as user@good-corp.com(x)evil.com is parsed as the single domain good-corp.comevil.com, whose registrable domain (comevil.com) can be registered by an attacker. Applications validating the recipient against a strict RFC 5322 parser or a naive allow-list can be induced to deliver mail to an attacker-controlled domain. The issue affects Nodemailer versions >= 6.9.16 and < 9.1.0, and is fixed in 9.1.0.

Critical Impact
Attackers can bypass recipient domain validation and redirect outbound email — including password resets, invoices, and internal notifications — to domains they control.

Affected Products

Nodemailer >= 6.9.16 and < 9.1.0
Node.js applications performing recipient validation before invoking Nodemailer
Downstream frameworks and services embedding vulnerable Nodemailer builds

Discovery Timeline

2026-09-16 - CVE-2026-92597 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92597

Vulnerability Analysis

The defect is an interpretation conflict [CWE-436] between Nodemailer's address parser and conformant RFC 5322 parsers. RFC 5322 treats a comment as folding whitespace that terminates the domain portion of an addr-spec. Nodemailer, however, treats a comment token as a noBreak boundary and appends the following atom directly to the preceding one when the comment is immediately followed by a non-break character.

The result is that a validator and Nodemailer disagree about the effective recipient domain for the same address string. A strict parser reads user@good-corp.com(x)evil.com as user@good-corp.com. Nodemailer reads the same string as user@good-corp.comevil.com and uses that domain in both the SMTP envelope RCPT TO and the emitted To:/From: headers.

Root Cause

The root cause resides in lib/addressparser/index.js. When the previous token is marked noBreak and the current token is a comment (cfws), the parser unconditionally glues the next atom to the tail of the current state. It does not check whether the join crosses the @ boundary of an address, allowing two distinct atoms to be fused into a single domain.

Attack Vector

An attacker supplies a crafted recipient address to any application that validates the domain against an allow-list and then passes the raw string to Nodemailer. The application accepts the address because the strict parser sees the legitimate domain. Nodemailer then delivers to the attacker-controlled registrable domain. Password reset links, one-time codes, invoices, and internal correspondence can be redirected.

javascript

                token.value = token.value.replace(/^[^<]*<\s*/, '');
            }

-            if (prevToken && prevToken.noBreak && data[state].length) {
+            // A comment is folding whitespace. It may sit inside an addr-spec, on either
+            // side of the '@', but it cannot join two atoms into one: gluing across it
+            // would read 'user@example.com(x)evil.com' as the single domain
+            // 'example.comevil.com' and deliver to a domain the sender never named.
+            const tail = data[state].length ? data[state][data[state].length - 1] : '';
+            const joinsAcrossComment = tail.slice(-1) === '@' || token.value.charAt(0) === '@';
+
+            if (prevToken && prevToken.noBreak && data[state].length && (!prevToken.cfws || joinsAcrossComment)) {
                data[state][data[state].length - 1] += token.value;
                if (state === 'text' && insideQuotes) {
                    data.textWasQuoted[data.textWasQuoted.length - 1] = true;

Source: Nodemailer commit 902b63e. The patch inspects whether the comment sits across the @ boundary and refuses to glue atoms when the comment acts as folding whitespace terminating the domain.

Detection Methods for CVE-2026-92597

Indicators of Compromise

Outbound SMTP RCPT TO commands targeting domains that resemble concatenations of two legitimate labels (for example comevil.com, orgattacker.net).
Mail logs showing To: header domains that do not match the domain requested by the application layer.
Recipient addresses in application logs containing parenthesized comment tokens such as (x), (a), or (cfws) adjacent to the @ sign.

Detection Strategies

Inventory Node.js dependencies with npm ls nodemailer and flag any version >= 6.9.16 and < 9.1.0.
Add a pre-send hook that re-parses recipient addresses with a strict RFC 5322 parser and compares the extracted domain to the domain Nodemailer will use.
Compare application-layer recipient records against SMTP relay logs to surface envelope/header divergence.

Monitoring Recommendations

Alert on outbound mail to newly registered domains, especially domains whose labels concatenate substrings of trusted domains.
Track anomalous volumes of password-reset and account-recovery mail to external domains.
Log any recipient string containing ( or ) characters and route to a review queue.

How to Mitigate CVE-2026-92597

Immediate Actions Required

Upgrade Nodemailer to version 9.1.0 or later in all Node.js services.
Audit any recipient allow-list logic that relies on prefix or substring matching and replace it with exact registrable-domain matching.
Reject addresses containing RFC 5322 comment syntax at the application boundary if comments are not required.

Patch Information

The fix is delivered in Nodemailer 9.1.0 via commit 902b63e. Additional detail is available in the GitHub Security Advisory GHSA-cc9r-2j5m-2m83 and the VulnCheck advisory.

Workarounds

Strip or reject addresses containing ( or ) characters before invoking Nodemailer.
Re-parse each recipient with a conformant RFC 5322 parser and compare the extracted domain to the value passed to Nodemailer; abort on mismatch.
Restrict outbound SMTP delivery at the mail relay to a vetted allow-list of registrable domains.

bash

# Upgrade Nodemailer to the fixed release
npm install nodemailer@^9.1.0

# Verify no vulnerable versions remain in the dependency tree
npm ls nodemailer