The vulnerability in Nodemailer prior to version 9.1.0 involves improper handling of internationalized domain names (IDNs). Specifically, the software fails to apply UTS-46 normalization during encoding, leading to discrepancies in the computed Punycode A-label compared to standards-compliant parsers. This inconsistency allows attackers to create recipient addresses with invisible or compatibility-mapped characters that evade domain allow-list filters but ultimately route emails to attacker-controlled domains. This can undermine domain-based security controls relying on allow-lists.

This vulnerability can lead to bypassing domain allow-list checks in email sending workflows, potentially causing emails intended for trusted domains to be redirected to attacker-controlled domains. The impact includes confidentiality risks due to misdirected emails. The CVSS score of 6.5 (high severity) reflects a network attack vector with high confidentiality impact but low integrity and no availability impact. Exploitation requires high attack complexity and no privileges or user interaction.

A fix is available in Nodemailer version 9.1.0 and later, which correctly applies UTS-46 normalization for international domain names. Users should upgrade to version 9.1.0 or newer to remediate this issue. Since this is a software library, patching the dependency in affected applications is necessary. No vendor advisory content was provided, so patch status is inferred from the version information in the description.