{"id":"CVE-2026-92598","aliases":["CLSA-2026-1790202437","CLSA-2026-1791511288","CLSA-2026-1791806459","CLSA-2026-1792115492","CLSA-2026-1792115522","CLSA-2026-1792139110","CLSA-2026-1792429360","DEBIAN-CVE-2026-92598","EUVD-2026-81298","GHSA-2x7j-588g-ccc2","GHSA-8m3c-c648-2xjj","GHSA-8vvx-rff5-p5rq","GHSA-cc9r-2j5m-2m83","GHSA-r7q5-h7cx-p54x","GHSA-v53p-9fqp-m79j","GHSA-wmmp-3585-3rmp","UBUNTU-CVE-2026-92598"],"status":"published","title":"Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass","description":"Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings that pass domain allow-list checks but are delivered to attacker-controlled domains via SMTP.","severity":{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00395,"percentile":0.34058,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-436"],"published":"2026-09-16T21:47:02Z","modified":"2026-10-28T20:17:26Z","fixes":[{"ecosystem":"Debian:14","package":"node-nodemailer","fixed_in":["10.0.0+~8.0.1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.2-tuxcare.0"},{"fixed":"2.7.2-tuxcare.6"}]}],"versions":["2.7.2","2.7.2-tuxcare.1","2.7.2-tuxcare.2","2.7.2-tuxcare.3","2.7.2-tuxcare.4","2.7.2-tuxcare.5"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.1-tuxcare.0"},{"fixed":"9.0.1-tuxcare.1"}]}],"versions":["9.0.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.6-tuxcare.0"},{"fixed":"9.0.6-tuxcare.1"}]}],"versions":["9.0.6"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.3-tuxcare.0"},{"fixed":"9.0.3-tuxcare.3"}]}],"versions":["9.0.3","9.0.3-tuxcare.1","9.0.3-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.2-tuxcare.0"},{"fixed":"9.0.2-tuxcare.3"}]}],"versions":["9.0.2","9.0.2-tuxcare.1","9.0.2-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.5-tuxcare.0"},{"fixed":"9.0.5-tuxcare.3"}]}],"versions":["9.0.5","9.0.5-tuxcare.1","9.0.5-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-tuxcare.0"},{"fixed":"9.0.0-tuxcare.4"}]}],"versions":["9.0.0","9.0.0-tuxcare.1","9.0.0-tuxcare.2","9.0.0-tuxcare.3"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"node-nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.0.0+~8.0.1-1","10.0.10+~8.0.1-1","6.10.0+~6.4.17-1","6.8.0+~6.4.6-1","6.9.13+~6.4.14-1","6.9.15+~6.4.16-1","6.9.16+~6.4.16-1","6.9.4+~6.4.9-1","6.9.4+~6.4.9-2","6.9.4+~6.4.9-3","6.9.4+~6.4.9-4","7.0.10+~7.0.2-1","7.0.12+~7.0.5-1","7.0.5+~7.0.1-1","7.0.6+~7.0.1-1","7.0.9+~7.0.2-1","7.0.9+~7.0.2-2","8.0.11+~8.0.1-1","8.0.2+~7.0.11-1","8.0.3+~7.0.11-1","8.0.4+~7.0.11-1","8.0.4+~7.0.11-2","9.0.0+~8.0.1-1","9.0.3+~8.0.1-1","9.0.5+~8.0.1-1","9.0.6+~8.0.1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.0.0+~8.0.1-1","10.0.10+~8.0.1-1","6.10.0+~6.4.17-1","6.10.0+~6.4.17-1+deb13u1","7.0.10+~7.0.2-1","7.0.12+~7.0.5-1","7.0.5+~7.0.1-1","7.0.6+~7.0.1-1","7.0.9+~7.0.2-1","7.0.9+~7.0.2-2","8.0.11+~8.0.1-1","8.0.2+~7.0.11-1","8.0.3+~7.0.11-1","8.0.4+~7.0.11-1","8.0.4+~7.0.11-2","9.0.0+~8.0.1-1","9.0.3+~8.0.1-1","9.0.5+~8.0.1-1","9.0.6+~8.0.1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.0+~8.0.1-1"}]}],"versions":["6.10.0+~6.4.17-1","7.0.10+~7.0.2-1","7.0.12+~7.0.5-1","7.0.5+~7.0.1-1","7.0.6+~7.0.1-1","7.0.9+~7.0.2-1","7.0.9+~7.0.2-2","8.0.11+~8.0.1-1","8.0.2+~7.0.11-1","8.0.3+~7.0.11-1","8.0.4+~7.0.11-1","8.0.4+~7.0.11-2","9.0.0+~8.0.1-1","9.0.3+~8.0.1-1","9.0.5+~8.0.1-1","9.0.6+~8.0.1-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.3.0-2","6.3.1-1","6.4.0-1","6.4.1-1","6.4.2-1","6.4.5-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.4.17-3","6.7.0-1","6.7.0-2","6.7.1+~6.4.4-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.9.4+~6.4.9-2","6.9.4+~6.4.9-3ubuntu1","6.9.4+~6.4.9-4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.0.4+~7.0.11-1","8.0.4+~7.0.11-2","9.0.0+~8.0.1-1","9.0.3+~8.0.1-1","9.0.5+~8.0.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.5+~7.0.1-1","7.0.9+~7.0.2-2","7.0.10+~7.0.2-1","7.0.12+~7.0.5-1","8.0.4+~7.0.11-1"]}],"products":[{"vendor":"nodemailer","product":"nodemailer"}],"references":[{"url":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-wmmp-3585-3rmp","tags":["vendor-advisory","exploit","advisory","report"]},{"url":"https://github.com/nodemailer/nodemailer/commit/259c32d","tags":["patch","fix"]},{"url":"https://github.com/nodemailer/nodemailer/commit/b212ac4","tags":["patch","fix"]},{"url":"https://www.vulncheck.com/advisories/nodemailer-before-9.1.0-idn-punycode-domain-allow-list-bypass","tags":["third-party-advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92598","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-r7q5-h7cx-p54x"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92598.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-92598","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-92598","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-92598","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-92598","title":"Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass","description":"Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings that pass domain allow-list checks but are delivered to attacker-controlled domains via SMTP.","status":"published","published":"2026-09-16T21:47:02.365Z","modified":"2026-09-17T14:43:20.281Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T13:48:24.536396Z"}],"euvd":[{"id":"EUVD-2026-81298","description":"Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings that pass domain allow-list checks but are delivered to attacker-controlled domains via SMTP.","status":"published","published":"2026-09-16T21:47:02Z","modified":"2026-09-17T14:43:20Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:28:12.076337Z"}],"ghsa":[{"id":"GHSA-r7q5-h7cx-p54x","title":"Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain...","description":"Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings that pass domain allow-list checks but are delivered to attacker-controlled domains via SMTP.","status":"published","published":"2026-09-17T00:31:27Z","modified":"2026-09-17T00:31:32Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T15:12:03.458644Z"}],"nvd":[{"id":"CVE-2026-92598","description":"Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings that pass domain allow-list checks but are delivered to attacker-controlled domains via SMTP.","status":"published","published":"2026-09-16T22:18:30.84Z","modified":"2026-09-22T20:25:55.87Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T14:12:49.013904Z"}],"osv":[{"id":"CVE-2026-92598","title":"Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass","description":"Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings that pass domain allow-list checks but are delivered to attacker-controlled domains via SMTP.","status":"published","published":"2026-09-16T21:47:02.365Z","modified":"2026-10-28T02:30:31.305070838Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T15:45:20.588039Z"},{"id":"DEBIAN-CVE-2026-92598","description":"Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings that pass domain allow-list checks but are delivered to attacker-controlled domains via SMTP.","status":"published","published":"2026-09-16T22:18:30.84Z","modified":"2026-09-23T08:47:25.740985504Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:46:06.846102Z"},{"id":"UBUNTU-CVE-2026-92598","description":"Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings that pass domain allow-list checks but are delivered to attacker-controlled domains via SMTP.","status":"published","published":"2026-09-16T22:18:00Z","modified":"2026-10-28T20:17:26.897781596Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium"},{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:57:40.980117Z"},{"id":"CLSA-2026-1790202437","title":"TuxCare security update for nodemailer (4 CVEs)","description":"TuxCare rebuilt nodemailer to address 4 CVEs. Fixed in 2.7.2-tuxcare.6.","status":"published","published":"2026-09-23T22:27:17Z","modified":"2026-10-15T09:47:56.451035591Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1791511288","title":"TuxCare security update for nodemailer (4 CVEs)","description":"TuxCare rebuilt nodemailer to address 4 CVEs. Fixed in 9.0.1-tuxcare.1.","status":"published","published":"2026-10-09T02:01:28Z","modified":"2026-10-15T09:48:04.402139932Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791806459","title":"TuxCare security update for nodemailer (11 CVEs)","description":"TuxCare rebuilt nodemailer to address 11 CVEs. Fixed in 9.0.6-tuxcare.1.","status":"published","published":"2026-10-12T12:00:58Z","modified":"2026-10-15T09:47:40.200342402Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792115492","title":"TuxCare security update for nodemailer (2 CVEs)","description":"TuxCare rebuilt nodemailer to address 2 CVEs. Fixed in 9.0.3-tuxcare.3.","status":"published","published":"2026-10-16T01:51:32Z","modified":"2026-10-16T07:00:02.260729892Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792115522","title":"TuxCare security update for nodemailer (2 CVEs)","description":"TuxCare rebuilt nodemailer to address 2 CVEs. Fixed in 9.0.2-tuxcare.3.","status":"published","published":"2026-10-16T01:52:02Z","modified":"2026-10-16T07:00:02.390730108Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792139110","title":"TuxCare security update for nodemailer (2 CVEs)","description":"TuxCare rebuilt nodemailer to address 2 CVEs. Fixed in 9.0.5-tuxcare.3.","status":"published","published":"2026-10-16T08:25:10Z","modified":"2026-10-16T12:15:02.201622682Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792429360","title":"TuxCare security update for nodemailer (2 CVEs)","description":"TuxCare rebuilt nodemailer to address 2 CVEs. Fixed in 9.0.0-tuxcare.4.","status":"published","published":"2026-10-19T17:02:40Z","modified":"2026-10-19T19:15:22.940950778Z","updated_at":"2026-11-02T15:43:54.119956Z"}]}}