Executive brief
Nodemailer, a popular Node.js email library, normalizes international domain names (IDN) differently than web browsers and standard validators. An attacker can craft an email recipient address with invisible Unicode characters that bypasses domain allow-list checks, causing emails to be delivered to an attacker-controlled domain instead of the intended recipient. Applications relying on Nodemailer for email delivery after validating domains with standard parsers can be tricked into sending sensitive communications to wrong domains.
Technical details
The vulnerability exists in `lib/mime-node/index.js` in the `_normalizeAddress()` function, which uses Nodemailer's bundled RFC 3492 Punycode codec for domain encoding. Unlike UTS-46-compliant parsers (browsers, Node.js url.domainToASCII, Python's idna library), Nodemailer's codec performs only `.toLowerCase()` normalization, omitting critical UTS-46 steps: removal of ignored code points (e.g., U+00AD soft hyphen), mapping of full-width/compatibility characters, Unicode NFC normalization, and validity checks. As a result, a domain like `victim@company.com` (with invisible U+00AD) passes validation as `company.com` but encodes to `xn--company-pka.com` in Nodemailer, which is written to the SMTP envelope and email headers. The fix in version 9.1.0 applies UTS-46 processing before Punycode encoding, aligning Nodemailer's output with standard parsers.
Affected products
- Nodemailer Project Nodemailer < 9.1.0
Timeline
- 2026-09-01: disclosed: GitHub Advisory published
- 2026-09-01: patched: Fix released in version 9.1.0 (commit 259c32d applies UTS-46 processing; commit b212ac4 hardened character filtering)