EUVD-2026-81298Published
Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-92598 · CVE overview and exploitation status
cve-program · CVE-2026-92598
- https://github.com/nodemailer/nodemailer/security/advisories/GHSA-wmmp-3585-3rmp
- https://github.com/nodemailer/nodemailer/commit/259c32d
- https://github.com/nodemailer/nodemailer/commit/b212ac4
- https://www.vulncheck.com/advisories/nodemailer-before-9.1.0-idn-punycode-domain-allow-list-bypass
euvd · EUVD-2026-81298
- https://github.com/nodemailer/nodemailer/security/advisories/GHSA-wmmp-3585-3rmp
- https://github.com/nodemailer/nodemailer/commit/259c32d
- https://github.com/nodemailer/nodemailer/commit/b212ac4
- https://www.vulncheck.com/advisories/nodemailer-before-9.1.0-idn-punycode-domain-allow-list-bypass
nvd · CVE-2026-92598
- https://github.com/nodemailer/nodemailer/commit/259c32d
- https://github.com/nodemailer/nodemailer/commit/b212ac4
- https://github.com/nodemailer/nodemailer/security/advisories/GHSA-wmmp-3585-3rmp
- https://www.vulncheck.com/advisories/nodemailer-before-9.1.0-idn-punycode-domain-allow-list-bypass
osv · GHSA-wmmp-3585-3rmp
- https://github.com/nodemailer/nodemailer/security/advisories/GHSA-wmmp-3585-3rmp
- https://github.com/nodemailer/nodemailer/pull/1848
- https://github.com/nodemailer/nodemailer/commit/259c32d7d266301e3377a212776c3fff993c0148
- https://github.com/nodemailer/nodemailer/commit/b212ac4e27bce8182478044fcb8d1642ccdad46e
- https://github.com/nodemailer/nodemailer
- https://github.com/nodemailer/nodemailer/releases/tag/v9.1.0