CVE-2026-92597 nodemailer CVE debrief

Who should care

Defenders responsible for email delivery configurations, especially those using Nodemailer versions between 6.9.16 and 9.1.0, should assess exposure and verify configurations to prevent potential domain validation bypasses. This includes reviewing email delivery configurations, implementing strict RFC 5322 parsing for recipient addresses, and verifying the recipient domain with a strict RFC 5322 parser or a naive prefix/substring allow-list.

Why it matters

CVE-2026-92597 Nodemailer domain validation bypass requires verification of email delivery configurations to prevent potential exploitation.

• Potential delivery of mail to unauthorized domains
• Bypass of strict RFC 5322 parsing and naive prefix/substring allow-lists
• Verification of email delivery configurations required
• Possible exploitation requires further verification

Technical summary

Nodemailer versions >= 6.9.16 and < 9.1.0 mis-parse RFC 5322 comments in email addresses, potentially leading to domain validation bypasses. An attacker can manipulate the recipient address to deliver mail to a domain under their control by exploiting the incorrect handling of comments in email addresses. This can result in the delivery of mail to a domain controlled by an attacker if the recipient domain is validated with a strict RFC 5322 parser or a naive prefix/substring allow-list and then handed to Nodemailer.

Defensive priority

Defenders should prioritize verifying email delivery configurations, especially those using Nodemailer versions between 6.9.16 and 9.1.0, to prevent potential domain validation bypasses.

Recommended defensive actions

• Verify and update Nodemailer to version 9.1.0 or later
• Review email delivery configurations for potential domain validation bypasses
• Implement strict RFC 5322 parsing for recipient addresses
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The CVE record and NVD entry provide details on a domain validation bypass vulnerability in Nodemailer versions >= 6.9.16 and < 9.1.0 due to mis-parsing of RFC 5322 comments in email addresses. The vulnerability is caused by the incorrect handling of comments in email addresses, which can lead to the concatenation of atoms surrounding the comment instead of treating the comment as folding whitespace that terminates the domain. This can result in the delivery of mail to a domain controlled by an attacker. Defenders should verify email

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.