{"id":"EUVD-2026-81298","enisaUuid":"1cd2ce33-7a70-39cf-b019-29399f13cc16","description":"Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings that pass domain allow-list checks but are delivered to attacker-controlled domains via SMTP.","datePublished":"Sep 16, 2026, 9:47:02 PM","dateUpdated":"Sep 17, 2026, 2:43:20 PM","baseScore":8.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-wmmp-3585-3rmp\nhttps://github.com/nodemailer/nodemailer/commit/259c32d\nhttps://github.com/nodemailer/nodemailer/commit/b212ac4\nhttps://www.vulncheck.com/advisories/nodemailer-before-9.1.0-idn-punycode-domain-allow-list-bypass\n","aliases":"CVE-2026-92598\nGHSA-r7q5-h7cx-p54x\n","assigner":"VulnCheck","epss":0.4,"enisaIdProduct":[{"id":"3e91d53a-88fb-3d4c-b3dd-c72cf8fd12bd","product":{"name":"nodemailer","vendor":{"name":"nodemailer"}},"product_version":"0 \u003c9.1.0"}],"enisaIdVendor":[{"id":"4adbdd0d-683f-35a7-95bd-8d625dd25cbf","vendor":{"name":"nodemailer"}}],"enisaIdVulnerability":[{"id":"404b9b28-c969-3fc2-a4db-882b4d42603b","vulnerability":{"id":"CVE-2026-92598","description":"Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings that pass domain allow-list checks but are delivered to attacker-controlled domains via SMTP.","datePublished":"Sep 16, 2026, 9:47:02 PM","dateUpdated":"Sep 17, 2026, 2:43:20 PM","status":"PUBLISHED","baseScore":8.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-wmmp-3585-3rmp\nhttps://github.com/nodemailer/nodemailer/commit/259c32d\nhttps://github.com/nodemailer/nodemailer/commit/b212ac4\nhttps://www.vulncheck.com/advisories/nodemailer-before-9.1.0-idn-punycode-domain-allow-list-bypass\n","enisa_id":"EUVD-2026-81298\n","assigner":"VulnCheck","epss":0.4,"dataProcessed":"Nov 13, 2026, 7:21:32 AM","vulnerabilityProduct":[{"id":"760d1ed5-ffcb-3b51-b842-968b23fd24d8","product":{"name":"nodemailer","vendor":{"name":"nodemailer"}},"product_version":"0 \u003c9.1.0"}],"vulnerabilityVendor":[{"id":"8f701a13-ee17-3bc8-a7c6-f1ed7dc8b7b6","vendor":{"name":"nodemailer"}}]}},{"id":"82431ae8-d18d-3341-8e6b-9479d7f22775","vulnerability":{"id":"GHSA-r7q5-h7cx-p54x","description":"Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings that pass domain allow-list checks but are delivered to attacker-controlled domains via SMTP.","datePublished":"Sep 17, 2026, 12:31:27 AM","dateUpdated":"Sep 17, 2026, 12:31:27 AM","baseScore":0.0,"references":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-wmmp-3585-3rmp\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-92598\nhttps://github.com/nodemailer/nodemailer/commit/259c32d\nhttps://github.com/nodemailer/nodemailer/commit/b212ac4\nhttps://www.vulncheck.com/advisories/nodemailer-before-9.1.0-idn-punycode-domain-allow-list-bypass\n","enisa_id":"EUVD-2026-81298\n","aliases":"CVE-2026-92598\nGHSA-r7q5-h7cx-p54x\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:53:48 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"31f19b76-dd57-3717-875c-184eefe7c81f","advisory":{"id":"WID-SEC-W-2026-3621","description":"IBM App Connect Enterprise: Mehrere Schwachstellen","summary":"Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Informationen offenzulegen, um einen Denial of Service Angriff durchzuführen, um Daten zu manipulieren und um Sicherheitsvorkehrungen zu umgehen.","datePublished":"Sep 28, 2026, 10:00:00 PM","dateUpdated":"Nov 9, 2026, 11:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3621.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2026-3621\n","aliases":"CVE-2022-35948\nCVE-2026-13697\nCVE-2026-14643\nCVE-2026-15157\nCVE-2026-1527\nCVE-2026-16728\nCVE-2026-16729\nCVE-2026-59871\nCVE-2026-59873\nCVE-2026-59874\nCVE-2026-59875\nCVE-2026-92595\nCVE-2026-92596\nCVE-2026-92597\nCVE-2026-92598\nCVE-2026-9678\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"298227bf-9e0b-324a-b12d-3645db881772","product":{"name":"Certified Container Operator 13.7.0","vendor":{"name":"IBM"}}},{"id":"a3910b2c-209e-3ced-8be5-e1fd94ba32d4","product":{"name":"App Connect Enterprise","vendor":{"name":"IBM"}}},{"id":"d9285d09-f075-3fbe-838e-d38ea4f0512c","product":{"name":"Certified Container Operator 12.0.29","vendor":{"name":"IBM"}}},{"id":"de25174d-290f-3b64-8193-e4b54d26c45d","product":{"name":"13.0.9.0","vendor":{"name":"IBM"}}}]}}]}