Email Domain Validation Bypass in Nodemailer by Nodemailer
CVE-2026-92597

8.3HIGH

Key Information:

Vendor

Nodemailer

Status
Nodemailer
Vendor
CVE Published:
16 September 2026

What is CVE-2026-92597?

A vulnerability in Nodemailer versions 6.9.16 to below 9.1.0 allows for an email domain validation bypass due to improper parsing of RFC 5322 comments in email addresses. This occurs when comments directly precede non-break characters, causing the tokenizer to incorrectly merge domains. Consequently, an attacker can register a malicious domain and exploit this flaw to deliver emails to their controlled domain by manipulating the recipient address. Applications relying on strict RFC 5322 validation or simplistic allow-lists can inadvertently facilitate this attack. Users are advised to upgrade to Nodemailer version 9.1.0 or later to mitigate this security risk.

Affected Version(s)

nodemailer 6.9.16 < 9.1.0

nodemailer 9.1.0

References

https://github.com/nodemailer/nodemailer/security/advisor...
vendor-advisory
https://github.com/nodemailer/nodemailer/commit/902b63e
patch
https://www.vulncheck.com/advisories/nodemailer-before-9....
third-party-advisory

CVSS V4

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

e1abrador
.