GHSA-WMMP-3585-3RMP: IDN/Punycode Domain Allow-list Bypass in Nodemailer

Vulnerability ID: GHSA-WMMP-3585-3RMP
CVSS Score: 5.9
Published: 2026-09-08

Nodemailer (prior to version 9.1.0) is vulnerable to an IDN/Punycode domain allow-list bypass due to an interpretation conflict between legacy RFC-3492 codecs and modern UTS-46 Unicode parsers.

TL;DR

Interpretation conflict in Nodemailer allows bypassing domain allow-lists to redirect sensitive emails to attacker-controlled domains.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-436 / CWE-20
• Attack Vector: Network
• CVSS Score: 5.9 (Medium)
• Exploit Status: PoC available
• KEV Status: Not listed
• Mitigation: Upgrade to Nodemailer 9.1.0+

Affected Systems

• Nodemailer (< 9.1.0)
• nodemailer: < 9.1.0 (Fixed in: 9.1.0)

Mitigation Strategies

• Upgrade Nodemailer to version 9.1.0 or higher
• Manually normalize email domains with UTS-46 before passing them to the mailer

Remediation Steps:

1. Update package.json dependency to 'nodemailer': '^9.1.0'
2. Run 'npm install' to apply the update
3. Verify SMTP delivery logs for xn-- prefixed domains

References

• GHSA-WMMP-3585-3RMP Advisory
• Nodemailer PR #1848
• Nodemailer Release Notes v9.1.0

Read the full report for GHSA-WMMP-3585-3RMP on our website for more details including interactive diagrams and full exploit analysis.