AIKIDO-2026-694317
nodemailer is vulnerable to Improper Input Validation
65
Medium Risk
This Affects:
nodemailerTL;DR
Nodemailer encodes address domains with a raw RFC 3492 Punycode codec that applies no UTS-46 mapping, so it disagrees with WHATWG and Node URL parsers on domains containing mapped or ignored code points. A domain carrying an invisible character such as a soft hyphen can pass an allow-list check as one name yet encode to a different deliverable domain. The same normalizer also mishandled host delimiters, letting a value like evil.example/x collapse to a deliverable host. The fix routes domains through UTS-46 mapping and keeps URL delimiters away from the mapper so validation and delivery agree.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application validates recipient domains against an allow-list or trusts encoded address domains built from untrusted input.
Background info
nodemailer is vulnerable to Improper Input Validation in versions 0.0.1 - 9.0.6.
How to fix this
Upgrade the nodemailer library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.