GHSA-WMMP-3585-3RMP: IDN/Punycode Domain Allow-list Bypass in Nodemailer
Vulnerability ID: GHSA-WMMP-3585-3RMP
CVSS Score: 5.9
Published: 2026-09-08
Nodemailer (prior to version 9.1.0) is vulnerable to an IDN/Punycode domain allow-list bypass due to an interpretation conflict between legacy RFC-3492 codecs and modern UTS-46 Unicode parsers.
TL;DR
Interpretation conflict in Nodemailer allows bypassing domain allow-lists to redirect sensitive emails to attacker-controlled domains.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-436 / CWE-20
- Attack Vector: Network
- CVSS Score: 5.9 (Medium)
- Exploit Status: PoC available
- KEV Status: Not listed
- Mitigation: Upgrade to Nodemailer 9.1.0+
Affected Systems
- Nodemailer (< 9.1.0)
-
nodemailer: < 9.1.0 (Fixed in:
9.1.0)
Mitigation Strategies
- Upgrade Nodemailer to version 9.1.0 or higher
- Manually normalize email domains with UTS-46 before passing them to the mailer
Remediation Steps:
- Update package.json dependency to 'nodemailer': '^9.1.0'
- Run 'npm install' to apply the update
- Verify SMTP delivery logs for xn-- prefixed domains
References
Read the full report for GHSA-WMMP-3585-3RMP on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)