Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings that pass domain allow-list checks but are delivered to attacker-controlled domains via SMTP.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
High
Difficult to exploit
Attack Requirements
Present
Additional conditions required
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
Low
Partial data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products 1
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Nodemailer Nodemailer
cpe:2.3:a:nodemailer:nodemailer:*:*:*:*:*:*:*:*
|
— |
9.1.0
|
References 4
https://github.com/nodemailer/nodemailer/security/advisories/GHSA-wmmp-3585-3rmp
GitHub Security Advisory (GHSA-wmmp-3585-3rmp)
https://github.com/nodemailer/nodemailer/commit/259c32d
Patch Commit
https://github.com/nodemailer/nodemailer/commit/b212ac4
Patch Commit
https://www.vulncheck.com/advisories/nodemailer-before-9.1.0-idn-punycode-domai…
VulnCheck Advisory: Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass