{"uuid": "61a068d9-86db-4190-b878-020388dfa9bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-WMMP-3585-3RMP", "type": "seen", "source": "https://gist.github.com/alon710/5d16343ca1e4ea17a35c27f6e94b12c6", "content": "# GHSA-WMMP-3585-3RMP: GHSA-WMMP-3585-3RMP: IDN/Punycode Domain Allow-list Bypass in Nodemailer\n\n> **CVSS Score:** 5.9\n> **Published:** 2026-09-08\n> **Full Report:** https://cvereports.com/reports/GHSA-WMMP-3585-3RMP\n\n## Summary\nNodemailer (prior to version 9.1.0) is vulnerable to an IDN/Punycode domain allow-list bypass due to an interpretation conflict between legacy RFC-3492 codecs and modern UTS-46 Unicode parsers.\n\n## TL;DR\nInterpretation conflict in Nodemailer allows bypassing domain allow-lists to redirect sensitive emails to attacker-controlled domains.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-436 / CWE-20\n- **Attack Vector**: Network\n- **CVSS Score**: 5.9 (Medium)\n- **Exploit Status**: PoC available\n- **KEV Status**: Not listed\n- **Mitigation**: Upgrade to Nodemailer 9.1.0+\n\n## Affected Systems\n\n- Nodemailer (< 9.1.0)\n- **nodemailer**: < 9.1.0 (Fixed in: `9.1.0`)\n\n## Mitigation\n\n- Upgrade Nodemailer to version 9.1.0 or higher\n- Manually normalize email domains with UTS-46 before passing them to the mailer\n\n**Remediation Steps:**\n1. Update package.json dependency to 'nodemailer': '^9.1.0'\n2. Run 'npm install' to apply the update\n3. Verify SMTP delivery logs for xn-- prefixed domains\n\n## References\n\n- [GHSA-WMMP-3585-3RMP Advisory](https://github.com/nodemailer/nodemailer/security/advisories/GHSA-wmmp-3585-3rmp)\n- [Nodemailer PR #1848](https://github.com/nodemailer/nodemailer/pull/1848)\n- [Nodemailer Release Notes v9.1.0](https://github.com/nodemailer/nodemailer/releases/tag/v9.1.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-WMMP-3585-3RMP) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-09T00:00:05.095910Z"}