GHSA-WMMP-3585-3RMP Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain

Summary Nodemailer resolves an international IDN / non-ASCII recipient domain to a different Punycode xn-- label than every UTS‑46‑conformant parser web browsers, the WHATWG URL Standard, Node's url.domainToASCII, Python's idna. Its address normalizer normalizeAddress in lib/mime-node/index.js us...