Nodemailer versions >= 6.9.16 and < 9.1.0 mis-parse RFC 5322 comments in email addresses: in lib/addressparser, a comment closed immediately before… (CVE-2026-92597)
Nodemailer versions >= 6.9.16 and < 9.1.0 mis-parse RFC 5322 comments in email addresses: in lib/addressparser, a comment closed immediately before a non-break character causes the tokenizer to concatenate the atoms surrounding the comment instead of treating the comment as folding whitespace that terminates the domain. A recipient address such as [email protected](x)evil.com is therefore read by Nodemailer as the single domain good-corp.comevil.com (registrable domain comevil.com, which an attacker can register) and used for both the SMTP envelope (RCPT TO) and the emitted To:/From: headers, while a conformant RFC 5322 parser terminates the domain at the comment and reads good-corp.com. An application that validates the recipient domain with a strict RFC 5322 parser (without inspecting parse defects) or a naive prefix/substring allow-list and then hands the raw address to Nodemailer can be induced to deliver mail to a domain the attacker controls. Fixed in 9.1.0.
AI Analysis
Technical Summary
Nodemailer versions >= 6.9.16 and < 9.1.0 have a parsing flaw in lib/addressparser related to RFC 5322 comments in email addresses. When a comment is closed immediately before a non-break character, the tokenizer concatenates the atoms surrounding the comment instead of treating the comment as folding whitespace that terminates the domain. For example, an address like [email protected](x)evil.com is parsed as [email protected], allowing an attacker to register the domain comevil.com and receive emails intended for good-corp.com. Applications that validate recipient domains with strict RFC 5322 parsers or naive allow-lists but then pass the raw address to Nodemailer can be tricked into delivering mail to attacker-controlled domains. This vulnerability is fixed in Nodemailer 9.1.0.
Potential Impact
This vulnerability can cause emails to be delivered to attacker-controlled domains due to incorrect parsing of email addresses containing comments. This can lead to information disclosure or interception of sensitive emails. The CVSS score is 6.5 (High), indicating a significant confidentiality impact with low integrity and no availability impact.
Mitigation Recommendations
Upgrade Nodemailer to version 9.1.0 or later, where this parsing issue is fixed. Until then, avoid passing raw email addresses containing comments to Nodemailer or implement additional validation to detect and reject malformed addresses. Patch status is confirmed fixed in 9.1.0.
Nodemailer versions >= 6.9.16 and < 9.1.0 mis-parse RFC 5322 comments in email addresses: in lib/addressparser, a comment closed immediately before… (CVE-2026-92597)
Description
Nodemailer versions >= 6.9.16 and < 9.1.0 mis-parse RFC 5322 comments in email addresses: in lib/addressparser, a comment closed immediately before a non-break character causes the tokenizer to concatenate the atoms surrounding the comment instead of treating the comment as folding whitespace that terminates the domain. A recipient address such as [email protected](x)evil.com is therefore read by Nodemailer as the single domain good-corp.comevil.com (registrable domain comevil.com, which an attacker can register) and used for both the SMTP envelope (RCPT TO) and the emitted To:/From: headers, while a conformant RFC 5322 parser terminates the domain at the comment and reads good-corp.com. An application that validates the recipient domain with a strict RFC 5322 parser (without inspecting parse defects) or a naive prefix/substring allow-list and then hands the raw address to Nodemailer can be induced to deliver mail to a domain the attacker controls. Fixed in 9.1.0.
CVSS v3.1
Score 6.5medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Nodemailer versions >= 6.9.16 and < 9.1.0 have a parsing flaw in lib/addressparser related to RFC 5322 comments in email addresses. When a comment is closed immediately before a non-break character, the tokenizer concatenates the atoms surrounding the comment instead of treating the comment as folding whitespace that terminates the domain. For example, an address like [email protected](x)evil.com is parsed as [email protected], allowing an attacker to register the domain comevil.com and receive emails intended for good-corp.com. Applications that validate recipient domains with strict RFC 5322 parsers or naive allow-lists but then pass the raw address to Nodemailer can be tricked into delivering mail to attacker-controlled domains. This vulnerability is fixed in Nodemailer 9.1.0.
Potential Impact
This vulnerability can cause emails to be delivered to attacker-controlled domains due to incorrect parsing of email addresses containing comments. This can lead to information disclosure or interception of sensitive emails. The CVSS score is 6.5 (High), indicating a significant confidentiality impact with low integrity and no availability impact.
Mitigation Recommendations
Upgrade Nodemailer to version 9.1.0 or later, where this parsing issue is fixed. Until then, avoid passing raw email addresses containing comments to Nodemailer or implement additional validation to detect and reject malformed addresses. Patch status is confirmed fixed in 9.1.0.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-8pjj-q6q6-qm29
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-92597"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6aab494255bf5e2cf59903ed
Added to database: 09/17/2026, 01:58:26 UTC
Last enriched: 09/17/2026, 02:01:52 UTC
Last updated: 09/17/2026, 04:21:33 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.