Nodemailer before 9.1.0 Email Domain Validation Bypass via RFC 5322 Comment

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-92597 · CVE overview and exploitation status

EUVD-2026-81297

GHSA-8pjj-q6q6-qm29

GHSA-cc9r-2j5m-2m83

cve-program · CVE-2026-92597

• https://github.com/nodemailer/nodemailer/security/advisories/GHSA-cc9r-2j5m-2m83
• https://github.com/nodemailer/nodemailer/commit/902b63e
• https://www.vulncheck.com/advisories/nodemailer-before-9.1.0-email-domain-validation-bypass-via-rfc-5322-comment

euvd · EUVD-2026-81297

• https://github.com/nodemailer/nodemailer/security/advisories/GHSA-cc9r-2j5m-2m83
• https://github.com/nodemailer/nodemailer/commit/902b63e
• https://www.vulncheck.com/advisories/nodemailer-before-9.1.0-email-domain-validation-bypass-via-rfc-5322-comment

nvd · CVE-2026-92597

• https://github.com/nodemailer/nodemailer/commit/902b63e
• https://github.com/nodemailer/nodemailer/security/advisories/GHSA-cc9r-2j5m-2m83
• https://www.vulncheck.com/advisories/nodemailer-before-9.1.0-email-domain-validation-bypass-via-rfc-5322-comment

osv · GHSA-cc9r-2j5m-2m83

• https://github.com/nodemailer/nodemailer/security/advisories/GHSA-cc9r-2j5m-2m83
• https://github.com/nodemailer/nodemailer/pull/1848
• https://github.com/nodemailer/nodemailer/commit/902b63e935435c30f4025901c0902dce64cd8880
• https://github.com/nodemailer/nodemailer
• https://github.com/nodemailer/nodemailer/releases/tag/v9.1.0

• Nodemailer versions >= 6.9.16 and < 9.1.0 mis-parse RFC 5322 comments in email addresses: in lib/addressparser, a comment closed immediately before a non-break character causes the tokenizer to concatenate the atoms surrounding the comment … · Advisory content revised · 11 Nov 2026