CVE-2026-92598

Executive Summary

CVE-2026-92598 is a domain-name validation bypass in Nodemailer versions prior to 9.1.0. The library fails to apply UTS-46 normalization when encoding internationalized domain names (IDNs), causing its internal Punycode A-label computation to diverge from that of standards-compliant mail parsers and resolvers. As a result, recipient addresses containing invisible Unicode characters or compatibility mappings can satisfy domain allow-list checks inside Nodemailer while being delivered by SMTP to a different, attacker-controlled domain—enabling domain allow-list bypass and potential outbound mail redirection. The vulnerability is unpatched across all tracked sources, with no public PoC, no Nuclei template, and no CISA KEV listing.

Technical Analysis

Nodemailer is a widely used Node.js SMTP client library for composing and sending email. The vulnerability resides in the address normalization and domain-resolution path used when Nodemailer prepares recipient domains for SMTP envelope handling. Per the NVD description, the root cause is that Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names. UTS-46 (Unicode Technical Standard #46) defines the canonicalization, normalization, and validation procedure for internationalized domain names, including mapping of compatibility characters, case folding, and normalization to NFC. Because Nodemailer skips this step, the Punycode A-label it computes for a given domain can differ from the A-label produced by standards-compliant parsers (e.g., downstream MTAs, DNS resolvers, and receiving mail systems).

The security-relevant consequence is a parsing differential. When Nodemailer evaluates a domain against an allow-list, it compares using its own non-normalized computation. A standards-compliant SMTP server, MTA, or resolver, however, will normalize the same string via UTS-46 and derive a different effective domain. This lets an attacker supply a recipient address whose domain passes Nodemailer's allow-list check yet routes to an attacker-controlled domain once the standards-compliant SMTP path is traversed.

The NVD description specifically identifies two classes of payload characters:

1. Invisible characters — Unicode code points that render as nothing or as a look-alike but participate in normalization/label computation differently across implementations.
2. Compatibility mappings — characters that UTS-46 maps to a different canonical form, producing divergent A-labels between Nodemailer and compliant parsers.

Because CVSS lists AV:N/AC:H, exploitation requires a specific deployment condition (e.g., an application that applies a domain allow-list using Nodemailer's own comparison logic) plus the ability to craft or inject a recipient address; C:H indicates high confidentiality impact (mail redirected to attacker-controlled domains can exfiltrate message content and any tokens/links enclosed), and I:L reflects the limited integrity impact of altered delivery routing.

Affected version range: Nodemailer before 9.1.0. The fix requires upgrading to 9.1.0 or later, which should apply proper UTS-46 normalization before computing the Punycode A-label. No vendor advisory URL, commit hash, or public patch reference is available from tracked sources at this time (patch confidence 0/4).

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-436, interpretation conflict / domain-name normalization bypass) and the NVD description. Specific function names, parameters, and endpoints are not provided in the source data and are therefore not asserted.

1. Reconnaissance / target identification. An attacker identifies a target application that uses a pre-9.1.0 Nodemailer version to send email and enforces a recipient-domain allow-list (for example, restricting outbound mail to @company.com or a set of partner domains). The attacker must be able to influence or supply a recipient address—directly (user-controllable "To" field) or indirectly (stored address, templating, webhook input).

2. Triggering the flaw class. The attacker submits a recipient address whose domain contains invisible characters or Unicode compatibility mappings. Nodemailer fails to apply UTS-46 normalization before Punycode encoding, so its computed A-label matches the allowed domain and the address passes the allow-list check. A standards-compliant parser downstream applies UTS-46 and derives a different A-label associated with an attacker-controlled domain. This is the classic interpretation-conflict pattern: two components disagree on the canonical interpretation of the same input bytes.

3. Execution / delivery method (class level). Because Nodemailer has already accepted the address as allow-listed, it proceeds to establish/use the SMTP path and transmits the message toward the attacker-influenced destination domain. The payload itself is not code; the malicious object is the crafted internationalized domain string. Success depends on the exact downstream SMTP/DNS stack and on how the application wired Nodemailer's domain check relative to the actual SMTP RCPT domain.

4. Post-exploitation impact. Email intended for internal/trusted destinations is redirected to an attacker-controlled mailbox. This can disclose message content, authentication links, password-reset tokens, internal notification contents, or sensitive business data. Where the sending application embeds per-recipient secrets or signed links, the attacker gains a high-value interception vector. The limited integrity score reflects potential abuse of the trust relationship rather than direct system compromise.

Detection hinges on recognizing non-ASCII / punycode recipient input and on the divergence between the allow-list evaluation domain and the SMTP transaction domain (see Detection Guidance).

Impact Assessment

• Confidentiality (C:H): High. Redirected mail can exfiltrate sensitive content, tokens, and links to attacker infrastructure.
• Integrity (I:L): Low, per CVSS. The primary effect is misrouting content rather than altering stored data or executing code.
• Availability (A:N): None stated.
• Scope (S:U): Unchanged; impact confined to the affected library's authorization decision and the resulting mail path.
• Attack Vector (AV:N) / AC:H / PR:N / UI:N: Remotely triggerable without privileges or user interaction, but with high complexity—requires a specific configuration (allow-list relying on Nodemailer) and a viable Unicode differential against the downstream stack.

Blast radius: Any Node.js application using Nodemailer <9.1.0 that depends on Nodemailer's own domain normalization to enforce trust boundaries (domain allow-lists, outbound-mail restrictions, internal-only recipient policies). Organizations using Nodemailer purely to send to fixed, statically validated recipients are largely unaffected. The most exposed deployments are multi-tenant SaaS notification services, ticketing/CRM platforms, and any workflow where an untrusted party can influence a recipient domain.

Note: EPSS is unscored by FIRST.org; no exploit code, Nuclei template, or CISA KEV entry exists. Prioritize based on exposure and use of domain allow-lists, not on active-exploitation signal.

Detection Guidance

Sigma Rule

title: Nodemailer IDN Domain Allow-list Bypass (CVE-2026-92598)
id: 6b2f4a19-9259-8c7c-1f3e-n0d3m41l3r
status: experimental
description: Detects recipient addresses containing non-ASCII or punycode domains that may indicate UTS-46 normalization bypass in Nodemailer < 9.1.0
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-92598
author: Valters IT Threat Intelligence
date: 2026-01-01
tags:
  - attack.initial-access
  - attack.t1190
logsource:
  product: nodejs
  category: application
detection:
  selection_process:
    process.command_line|contains: 'nodemailer'
  selection_smtp:
    event.action|contains:
      - 'mail.send'
      - 'smtp.rcpt'
  selection_domain:
    recipient.domain|contains:
      - 'xn--'
      - '\u200b'
      - '\u200c'
      - '\u200d'
      - '\ufeff'
  condition: (selection_process or selection_smtp) and selection_domain
falsepositives:
  - Legitimate internationalized email domains
  - Marketing systems sending to IDN recipients
level: medium

YARA Rule

rule CVE_2026_92598_Nodemailer_IDN_Allowlist_Bypass
{
    meta:
        description = "Detects possible Nodemailer UTS-46 normalization bypass payloads (CVE-2026-92598)"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-92598"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $re_utilities = "punycode" ascii nocase
        $nodemailer = "nodemailer" ascii nocase
        $mapping = "UTS-46" ascii nocase
        $mapping2 = "toASCII" ascii nocase
        $zwsp = { E2 80 8B }        // U+200B zero width space
        $zwnj = { E2 80 8C }        // U+200C zero width non-joiner
        $zwj  = { E2 80 8D }        // U+200D zero width joiner
        $bom  = { EF BB BF }        // U+FEFF BOM
        $xn   = "xn--" ascii

    condition:
        ($nodemailer or $re_utilities or $mapping or $mapping2)
        and ($xn or $zwsp or $zwnj or $zwj or $bom)
}

Suricata IDS Rule

alert smtp any any -> any 25 (msg:"CVE-2026-92598 Possible Nodemailer IDN Normalization Bypass - Punycode RCPT with Invisible Unicode"; flow:to_server,established; content:"RCPT TO"; nocase; content:"xn--"; nocase; content:"|E2 80 8B|"; sid:1002598; rev:1; metadata:created_at 2026_01_01, cve CVE_2026-92598, mitre_tactic_technique T1190; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-92598; classtype:attempted-recon;)
alert smtp any any -> any 587 (msg:"CVE-2026-92598 Possible Nodemailer IDN Normalization Bypass - RCPT with BOM/ZWJ"; flow:to_server,established; content:"RCPT TO"; nocase; pcre:"/\xEF\xBB\xBF|\xE2\x80\x8D|\xE2\x80\x8C/"; sid:1002599; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-92598, mitre_tactic_technique T1190; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-92598; classtype:attempted-recon;)

Elastic Detection

sequence by host.id, process.entity_id with maxspan=5s
  [process where process.name == "node" and process.command_line : "nodemailer"]
  [network where event.category == "network" and network.transport == "tcp"
   and (network.destination.port == 25 or network.destination.port == 587 or network.destination.port == 465)
   and process.name == "node"]

Splunk SPL Query

index=mail OR index=app_logs (sourcetype=nodemailer OR sourcetype=nodejs OR sourcetype=postfix)
| eval recip=coalesce(recipient, rcpt_to, to_address, message.recipient)
| where match(recip, "xn--") OR match(recip, "\xE2\x80\x8[BCD]") OR match(recip, "\xEF\xBB\xBF")
| stats count min(_time) as first_seen max(_time) as last_seen values(recip) as recipient_domains by src_ip, host, user
| where count > 1
| sort - count

Wazuh OSSEC Rule

<group name="nodemailer,cve-2026-92598,">
  <rule id="1002598" level="10">
    <decoded_as>json</decoded_as>
    <field name="recipient">xn--</field>
    <description>CVE-2026-92598: Possible Nodemailer IDN allow-list bypass - punycode recipient detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>smtp_abuse,</group>
  </rule>
  <rule id="1002599" level="12">
    <decoded_as>json</decoded_as>
    <regex field="recipient">\xE2\x80\x8[B-C]|\xEF\xBB\xBF</regex>
    <description>CVE-2026-92598: Invisible Unicode characters in email recipient domain - normalization bypass attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>smtp_abuse,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor advisory URL, commit, or fixed release artifact is confirmed by tracked sources; the NVD description states the issue is resolved in versions ≥9.1.0, but this must be independently verified before relying on it.

1. Immediate mitigations

   • Do not rely on Nodemailer for domain authorization. Perform recipient-domain allow-listing in application code using a UTS-46-compliant IDN library (e.g., a maintained idna/UTS-46 implementation in Node.js), and validate the fully normalized A-label before passing the address to Nodemailer.
   • Reject or strip recipient addresses containing non-ASCII characters, zero-width characters (U+200B–U+200D), BOM (U+FEFF), or unexpected punycode (xn--) labels unless explicitly required by business policy.
   • Log the recipient domain as evaluated by the allow-list and the SMTP RCPT domain, then alert on divergence.
   • For highest-risk paths, pin outbound recipients to a statically defined list that never passes through user-controlled Unicode input.

2. Patch / upgrade steps

   • Upgrade Nodemailer to 9.1.0 or later and re-run allow-list regression tests against known Unicode edge cases.
   • Verify the fix by testing that a crafted IDN address that previously passed the allow-list now normalizes consistently with a standards-compliant parser.
   • Because patch confidence is 0/4, treat the version claim as unverified: confirm the resolved behavior in a staging environment before deploying broadly, and monitor the Nodemailer project and NVD page for a formal advisory.

3. Long-term hardening

   • Adopt a single canonical IDN normalization path across the entire mail pipeline (input validation, storage, allow-list, SMTP envelope) to eliminate interpretation conflicts (CWE-436).
   • Implement unit tests with a corpus of homoglyph, zero-width, and compatibility-mapping domains to prevent regression.
   • Enforce a defense-in-depth egress control on SMTP destinations so that even a logic bypass cannot route mail to untrusted domains.
   • Inventory Nodemailer versions across all services and integrate SBOM-based alerting for this CVE ID.

References

• NVD — CVE-2026-92598: https://nvd.nist.gov/vuln/detail/CVE-2026-92598
• Nodemailer project (upstream library): https://github.com/nodemailer/nodemailer
• Unicode Technical Standard #46 (IDNA Compatibility Processing): https://unicode.org/reports/tr46/
• CWE-436 — Interpretation Conflict: https://cwe.mitre.org/data/definitions/436.html
• CVSS v3.1 Specification: https://www.first.org/cvss/v3.1/specification-document

Exploit-in-the-wild status: No public PoC, no Nuclei template, no exploit code, and no CISA KEV entry. No threat actor campaign is known to be associated with CVE-2026-92598 at the time of writing. All exploitation scenarios are inferred from the vulnerability class and the NVD description.