CVE-2026-92598
Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass
Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings that pass domain allow-list checks but are delivered to attacker-controlled domains via SMTP.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass
Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings that pass domain allow-list checks but are delivered to attacker-controlled domains via SMTP.
- Record
CVE-2026-92598- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-436
- Updated
- 2026-11-02
EUVDEUVD-2026-81298
Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings that pass domain allow-list checks but are delivered to attacker-controlled domains via SMTP.
- Record
EUVD-2026-81298- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-r7q5-h7cx-p54x
Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain...
Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings that pass domain allow-list checks but are delivered to attacker-controlled domains via SMTP.
- Record
GHSA-r7q5-h7cx-p54x- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-436
- Updated
- 2026-11-02
NVD
Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings that pass domain allow-list checks but are delivered to attacker-controlled domains via SMTP.
- Record
CVE-2026-92598- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-436
- Updated
- 2026-11-02
OSV
Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass
Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings that pass domain allow-list checks but are delivered to attacker-controlled domains via SMTP.
- Record
CVE-2026-92598- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-436
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-92598
Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings that pass domain allow-list checks but are delivered to attacker-controlled domains via SMTP.
- Record
DEBIAN-CVE-2026-92598- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
Show 8 moreShow less
OSVUBUNTU-CVE-2026-92598
Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings that pass domain allow-list checks but are delivered to attacker-controlled domains via SMTP.
- Record
UBUNTU-CVE-2026-92598- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1790202437 No score
TuxCare security update for nodemailer (4 CVEs)
TuxCare rebuilt nodemailer to address 4 CVEs. Fixed in 2.7.2-tuxcare.6.
- Record
CLSA-2026-1790202437- Updated
- 2026-11-02
OSVCLSA-2026-1791511288 No score
TuxCare security update for nodemailer (4 CVEs)
TuxCare rebuilt nodemailer to address 4 CVEs. Fixed in 9.0.1-tuxcare.1.
- Record
CLSA-2026-1791511288- Updated
- 2026-11-02
OSVCLSA-2026-1791806459 No score
TuxCare security update for nodemailer (11 CVEs)
TuxCare rebuilt nodemailer to address 11 CVEs. Fixed in 9.0.6-tuxcare.1.
- Record
CLSA-2026-1791806459- Updated
- 2026-11-02
OSVCLSA-2026-1792115492 No score
TuxCare security update for nodemailer (2 CVEs)
TuxCare rebuilt nodemailer to address 2 CVEs. Fixed in 9.0.3-tuxcare.3.
- Record
CLSA-2026-1792115492- Updated
- 2026-11-02
OSVCLSA-2026-1792115522 No score
TuxCare security update for nodemailer (2 CVEs)
TuxCare rebuilt nodemailer to address 2 CVEs. Fixed in 9.0.2-tuxcare.3.
- Record
CLSA-2026-1792115522- Updated
- 2026-11-02
OSVCLSA-2026-1792139110 No score
TuxCare security update for nodemailer (2 CVEs)
TuxCare rebuilt nodemailer to address 2 CVEs. Fixed in 9.0.5-tuxcare.3.
- Record
CLSA-2026-1792139110- Updated
- 2026-11-02
OSVCLSA-2026-1792429360 No score
TuxCare security update for nodemailer (2 CVEs)
TuxCare rebuilt nodemailer to address 2 CVEs. Fixed in 9.0.0-tuxcare.4.
- Record
CLSA-2026-1792429360- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nodemailerTuxCare:npm |
2.7.2-tuxcare.0 up to 2.7.2-tuxcare.6, plus listed versions 2.7.22.7.2-tuxcare.12.7.2-tuxcare.22.7.2-tuxcare.32.7.2-tuxcare.42.7.2-tuxcare.5 |
2.7.2-tuxcare.6 |
nodemailerTuxCare:npm |
9.0.1-tuxcare.0 up to 9.0.1-tuxcare.1, plus listed versions 9.0.1 |
9.0.1-tuxcare.1 |
nodemailerTuxCare:npm |
9.0.6-tuxcare.0 up to 9.0.6-tuxcare.1, plus listed versions 9.0.6 |
9.0.6-tuxcare.1 |
nodemailerTuxCare:npm |
9.0.3-tuxcare.0 up to 9.0.3-tuxcare.3, plus listed versions 9.0.39.0.3-tuxcare.19.0.3-tuxcare.2 |
9.0.3-tuxcare.3 |
nodemailerTuxCare:npm |
9.0.2-tuxcare.0 up to 9.0.2-tuxcare.3, plus listed versions 9.0.29.0.2-tuxcare.19.0.2-tuxcare.2 |
9.0.2-tuxcare.3 |
nodemailerTuxCare:npm |
9.0.5-tuxcare.0 up to 9.0.5-tuxcare.3, plus listed versions 9.0.59.0.5-tuxcare.19.0.5-tuxcare.2 |
9.0.5-tuxcare.3 |
nodemailerTuxCare:npm |
9.0.0-tuxcare.0 up to 9.0.0-tuxcare.4, plus listed versions 9.0.09.0.0-tuxcare.19.0.0-tuxcare.29.0.0-tuxcare.3 |
9.0.0-tuxcare.4 |
node-nodemailerDebian:12 |
All versions, plus listed versions 10.0.0+~8.0.1-110.0.10+~8.0.1-16.10.0+~6.4.17-16.8.0+~6.4.6-16.9.13+~6.4.14-1 Show 21 moreShow less6.9.15+~6.4.16-16.9.16+~6.4.16-16.9.4+~6.4.9-16.9.4+~6.4.9-26.9.4+~6.4.9-36.9.4+~6.4.9-47.0.10+~7.0.2-17.0.12+~7.0.5-17.0.5+~7.0.1-17.0.6+~7.0.1-17.0.9+~7.0.2-17.0.9+~7.0.2-28.0.11+~8.0.1-18.0.2+~7.0.11-18.0.3+~7.0.11-18.0.4+~7.0.11-18.0.4+~7.0.11-29.0.0+~8.0.1-19.0.3+~8.0.1-19.0.5+~8.0.1-19.0.6+~8.0.1-1 |
None known |
node-nodemailerDebian:13 |
All versions, plus listed versions 10.0.0+~8.0.1-110.0.10+~8.0.1-16.10.0+~6.4.17-16.10.0+~6.4.17-1+deb13u17.0.10+~7.0.2-1 Show 14 moreShow less7.0.12+~7.0.5-17.0.5+~7.0.1-17.0.6+~7.0.1-17.0.9+~7.0.2-17.0.9+~7.0.2-28.0.11+~8.0.1-18.0.2+~7.0.11-18.0.3+~7.0.11-18.0.4+~7.0.11-18.0.4+~7.0.11-29.0.0+~8.0.1-19.0.3+~8.0.1-19.0.5+~8.0.1-19.0.6+~8.0.1-1 |
None known |
node-nodemailerDebian:14 |
before 10.0.0+~8.0.1-1, plus listed versions 6.10.0+~6.4.17-17.0.10+~7.0.2-17.0.12+~7.0.5-17.0.5+~7.0.1-17.0.6+~7.0.1-1 Show 11 moreShow less7.0.9+~7.0.2-17.0.9+~7.0.2-28.0.11+~8.0.1-18.0.2+~7.0.11-18.0.3+~7.0.11-18.0.4+~7.0.11-18.0.4+~7.0.11-29.0.0+~8.0.1-19.0.3+~8.0.1-19.0.5+~8.0.1-19.0.6+~8.0.1-1 |
10.0.0+~8.0.1-1 |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
node-nodemailerUbuntu:20.04:LTS |
All versions, plus listed versions 6.3.0-26.3.1-16.4.0-16.4.1-16.4.2-16.4.5-1 |
None known |
node-nodemailerUbuntu:22.04:LTS |
All versions, plus listed versions 6.4.17-36.7.0-16.7.0-26.7.1+~6.4.4-1 |
None known |
node-nodemailerUbuntu:24.04:LTS |
All versions, plus listed versions 6.9.4+~6.4.9-26.9.4+~6.4.9-3ubuntu16.9.4+~6.4.9-4 |
None known |
node-nodemailerUbuntu:26.10 |
All versions, plus listed versions 8.0.4+~7.0.11-18.0.4+~7.0.11-29.0.0+~8.0.1-19.0.3+~8.0.1-19.0.5+~8.0.1-1 |
None known |
node-nodemailerUbuntu:26.04:LTS |
All versions, plus listed versions 7.0.5+~7.0.1-17.0.9+~7.0.2-27.0.10+~7.0.2-17.0.12+~7.0.5-18.0.4+~7.0.11-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-92598 is a high vulnerability (CVSS 8.3) in Nodemailer, published September 16, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 33rd percentile. Fixed in nodemailer 2.7.2-tuxcare.6.
References
github.com/nodemailer/nodemailer/security/advisories/GHSA-wmmp-3585-3rmp
vulncheck.com/advisories/nodemailer-before-9.1.0-idn-punycode-domain-allow-list-bypass
nvd.nist.gov/vuln/detail/CVE-2026-92598