← Vulnerability feed

Vulnerability record · CVE-2026-92598 · published 16 September 2026

CVE-2026-92598: Interpretation conflict vulnerability

Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings that pass domain allow-list checks but are delivered to attacker-controlled domains via SMTP.

8.3 CVSS 4.0 High EPSS 0.40% · top 68.9% CWE-436 · Interpretation conflict Awaiting Analysis
8.3CVSS 4.0 base score
0.40%EPSS exploitation probability, 30 days
NoNot in CISA KEV
0Affected product versions listed by NVD
5References
22 Sep 2026Last modified by NVD

Description

Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings that pass domain allow-list checks but are delivered to attacker-controlled domains via SMTP.

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

References

LinkTags
https://github.com/nodemailer/nodemailer/commit/259c32d
https://github.com/nodemailer/nodemailer/commit/b212ac4
https://github.com/nodemailer/nodemailer/security/advisories/GHSA-wmmp-3585-3rmp
https://www.vulncheck.com/advisories/nodemailer-before-9.1.0-idn-punycode-domain-allow-list-bypass
https://github.com/nodemailer/nodemailer/security/advisories/GHSA-wmmp-3585-3rmp

Track CVE-2026-92598 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-63030WordPress REST API route confusion leads to SQL injection and RCEWordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 contain a REST API batch endpoint route confusion flaw (CWE-436). Chained with the author__not_in…KEVEPSS 10%analysed8.0CVE-2025-48384Git config CRLF handling allows submodule path link-following code executionGit mishandles trailing carriage returns when writing config values, so a submodule path ending in CR is read back altered during submodule initializ…KEVEPSS 4.1%analysed

Source: NIST National Vulnerability Database (record CVE-2026-92598), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.