Executive brief
Nodemailer, a popular Node.js library for sending emails, incorrectly normalizes international domain names (IDN) when validating email recipients against domain allow-lists. An attacker can craft an email address with invisible or special Unicode characters that passes a standards-compliant validator but is delivered to a different attacker-controlled domain, bypassing email filtering and allow-lists and enabling unauthorized email delivery to external addresses.
Technical details
The vulnerability is an interpretation conflict (CWE-436) in the address normalization logic (_normalizeAddress in lib/mime-node/index.js). Nodemailer uses a raw RFC-3492 Punycode codec without UTS-46 mapping/normalization, while standard validators (Node's url.domainToASCII, browsers, Python's idna library) apply UTS-46 processing before encoding. This means Nodemailer converts a domain containing ignored/mapped characters (e.g., U+00AD SOFT HYPHEN or full-width characters) to a different xn-- label than what standards-compliant validators compute. An application that checks a recipient domain against an allow-list using a standards-compliant parser and then delivers via Nodemailer will send to the attacker's computed domain instead. The attack requires no user interaction and is triggered by specially crafted email addresses containing invisible or compatibility characters. The vulnerability was patched in version 9.1.0 by implementing proper UTS-46 normalization.
Affected products
- Nodemailer Nodemailer < 9.1.0
Timeline
- 2026-09-08: disclosed: Vulnerability published as GHSA-wmmp-3585-3rmp
- 2026-09-01: patched: Fixed in Nodemailer 9.1.0