CVE-2026-92597 Nodemailer before 9.1.0 Email Domain Validation Bypass via RFC 5322 Comment
Attackers can bypass email domain validation to deliver mail to attacker-controlled domains by exploiting RFC 5322 comment parsing flaws in Nodemailer.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-92597?
CVE-2026-92597 is a high-severity vulnerability in nodemailer, published on 16 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Nodemailer versions >= 6.9.16 and < 9.1.0 mis-parse RFC 5322 comments in email addresses: in lib/addressparser, a comment closed immediately before a non-break character causes the tokenizer to concatenate the atoms surrounding the comment instead of treating the comment as folding whitespace that terminates the domain. A recipient address such as [email protected](x)evil.com is therefore read by Nodemailer as the single domain good-corp.comevil.com (registrable domain comevil.com, which an attacker can register) and used for both the SMTP envelope (RCPT TO) and the emitted To:/From: headers, while a conformant RFC 5322 parser terminates the domain at the comment and reads good-corp.com. An application that validates the recipient domain with a strict RFC 5322 parser (without inspecting parse defects) or a naive prefix/substring allow-list and then hands the raw address to Nodemailer can be induced to deliver mail to a domain the attacker controls. Fixed in 9.1.0.
Weakness: CWE-436
Which versions are affected by CVE-2026-92597?
2 open source packages ship an affected version, including nodemailer.
| Package | Affected | Fixed in |
|---|---|---|
nodemailer npm | From 6.9.16 | 9.1.0 |
nodemailer npm | From 6.9.16 | 9.1.0 |
How do I fix CVE-2026-92597?
Upgrade nodemailer to 9.1.0 or later.
Is CVE-2026-92597 being exploited?
There is no known exploitation of CVE-2026-92597 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-MX71943, CLEANSTART-2026-NF96877, CLEANSTART-2026-ZC19840, DEBIAN-CVE-2026-92597, ECHO-caa4-97bc-c181, GHSA-8pjj-q6q6-qm29 and 13 more.