CVE-2026-92598 Overview
CVE-2026-92598 is a domain allow-list bypass in Nodemailer versions prior to 9.1.0. The library fails to apply Unicode Technical Standard 46 (UTS-46) normalization when encoding international domain names (IDN). As a result, Nodemailer's domain resolver computes a different Punycode A-label than standards-compliant parsers such as browsers and Domain Name System (DNS) resolvers. Attackers can craft recipient addresses containing invisible characters or Unicode compatibility mappings that pass application-level domain allow-list checks. The mail is then delivered via Simple Mail Transfer Protocol (SMTP) to attacker-controlled domains. The flaw is classified under [CWE-436] Interpretation Conflict.
Critical Impact
Attackers can exfiltrate sensitive email content, including password reset links and internal notifications, to attacker-controlled domains by bypassing sender-side domain allow-lists.
Affected Products
- Nodemailer versions prior to 9.1.0
- Node.js applications using Nodemailer for SMTP delivery
- Applications relying on Nodemailer's domain parsing for allow-list enforcement
Discovery Timeline
- 2026-09-16 - CVE-2026-92598 published to the National Vulnerability Database (NVD)
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-92598
Vulnerability Analysis
The vulnerability originates in Nodemailer's lib/mime-node/index.js module, which is responsible for encoding domain portions of recipient addresses. Standards-compliant IDN handling requires applying UTS-46 mapping before the Punycode A-label conversion. Nodemailer's bundled codec skipped this normalization step. This produced a divergent ASCII representation compared to what browsers and DNS resolvers compute for the same input.
Attackers can supply email addresses whose Unicode form maps to an allow-listed domain under naive comparison but resolves to a different registrable domain after WHATWG-compliant normalization. A second issue identified during remediation involved passing URL delimiter characters to the WHATWG domainToASCII parser. That parser truncates hosts at /, \, ?, and #, meaning a value like evil.example/mail.corp.example returns evil.example, redirecting mail to an unintended recipient.
Root Cause
The root cause is an interpretation conflict between Nodemailer's Punycode encoder and standards-compliant WHATWG host parsers. Without UTS-46 mapping, Unicode compatibility characters and invisible codepoints are not folded to their canonical form. Different components in the mail pipeline therefore make different trust decisions about the same input string.
Attack Vector
Exploitation requires an attacker to influence the recipient address supplied to a Nodemailer-based application. This is common in password reset flows, invitation systems, and notification services that accept user-controlled email input. The attack is network-based and requires no authentication, though it requires specific conditions in how the target application enforces domain policy.
// Patch: lib/mime-node/index.js - apply UTS-46 mapping when encoding a domain
const punycode = require('../punycode');
const { PassThrough } = require('stream');
const shared = require('../shared');
+const urlModule = require('url');
const mimeFuncs = require('../mime-funcs');
const qp = require('../qp');
Source: GitHub Commit 259c32d
// Patch: lib/mime-node/index.js - keep URL delimiters away from the domain mapper
const PLAIN_ADDRESS = /^[^\s"(),:;<>@[\\\]]+@[^\s"(),:;<>@[\\\]]+$/;
+// domainToASCII and domainToUnicode are WHATWG host parsers rather than plain IDNA
+// mappers, so they do more than map: they cut the host at '/', '\\', '?' and '#', drop C0
+// controls, and percent-decode. Handing them 'evil.example/mail.corp.example' returns the
+// deliverable 'evil.example', which would turn a value the bundled codec leaves as
+// unroutable garbage into mail for a domain the sender never named. None of these
+// characters are legal in a domain, so keep them away from the mapper.
+const URL_PARSER_UNSAFE = /[/\\?#%\\x00-\\x20\\x7F]/;
Source: GitHub Commit b212ac4
Detection Methods for CVE-2026-92598
Indicators of Compromise
- Outbound SMTP connections from application servers to unexpected destination domains that share visual similarity with allow-listed corporate domains.
- Recipient addresses in mail logs containing non-ASCII Unicode characters, zero-width joiners, or compatibility-mapped codepoints.
- Mail queue entries where the recipient domain differs between application audit logs and the actual SMTP RCPT TO command sent to the mail transfer agent.
Detection Strategies
- Compare the Punycode representation produced by the application against the output of a WHATWG-compliant parser such as Node.js URL or url.domainToASCII for every outbound recipient.
- Audit Software Bill of Materials (SBOM) data and package-lock.json files across Node.js services to identify Nodemailer versions prior to 9.1.0.
- Add allow-list validation logic that operates on the ASCII-normalized domain after UTS-46 mapping rather than on the raw user-supplied string.
Monitoring Recommendations
- Instrument mail-sending code paths to log both the original user input and the final resolved recipient domain for anomaly review.
- Alert on SMTP delivery attempts to newly-observed domains from applications that historically send to a bounded set of destinations.
- Track dependency inventory changes and flag services still pinned to vulnerable Nodemailer releases.
How to Mitigate CVE-2026-92598
Immediate Actions Required
- Upgrade Nodemailer to version 9.1.0 or later across all Node.js applications and services.
- Inventory all direct and transitive dependencies on Nodemailer using npm ls nodemailer and update lockfiles accordingly.
- Re-validate any domain allow-list logic that consumes Nodemailer's parsed output to ensure it operates on the normalized ASCII form.
Patch Information
The fix is delivered in Nodemailer 9.1.0 through two commits. Commit 259c32d applies UTS-46 mapping when encoding a domain by delegating to the Node.js url module. Commit b212ac4 introduces the URL_PARSER_UNSAFE regular expression to reject inputs containing URL delimiters or control characters before they reach the WHATWG host parser. Additional context is available in the GitHub Security Advisory GHSA-wmmp-3585-3rmp and the VulnCheck Advisory on Nodemailer.
Workarounds
- Enforce recipient domain allow-lists using an independent WHATWG-compliant parser such as url.domainToASCII before invoking Nodemailer.
- Reject any recipient address containing characters outside the Letter-Digit-Hyphen (LDH) ASCII subset unless explicitly required, and reject inputs containing /, \, ?, #, %, or control characters in the domain portion.
- Restrict outbound SMTP egress from application servers to a defined set of destination mail servers at the network layer.
# Upgrade Nodemailer to the patched release
npm install nodemailer@^9.1.0
# Verify the installed version
npm ls nodemailer
# Audit for known vulnerabilities in the dependency tree
npm audit --production
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
