EUVD-2026-81298

Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings...

CVE-2026-92598

Nodemailer before 9.1.0 (a widely used Node.js mail library) fails to apply UTS-46 normalization when encoding international domain names. This causes the library's internal domain resolver to compute a different Punycode A-label than standards-compliant parsers. An attacker can craft recipient a...

Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain

Summary Nodemailer resolves an international IDN / non-ASCII recipient domain to a different Punycode xn-- label than every UTS‑46‑conformant parser web browsers, the WHATWG URL Standard, Node's url.domainToASCII, Python's idna. Its address normalizer normalizeAddress in lib/mime-node/index.js us...

RUSTSEC-2024-0421 `idna` accepts Punycode labels that do not produce any non-ASCII when decoded

idna 0.5.0 and earlier accepts Punycode labels that do not produce any non-ASCII output, which means that either ASCII labels or the empty root label can be masked such that they appear unequal without IDNA processing or when processed with a different implementation and equal when processed with...