Interpretation Conflict Affecting nodemailer package, versions <9.1.0
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-NODEMAILER-19652370
- published9 Sept 2026
- disclosed8 Sept 2026
- creditEric Labrador Sainz
Introduced: 8 Sep 2026
New CVE NOT AVAILABLE CWE-436 (opens in a new tab)How to fix?
Upgrade nodemailer to version 9.1.0 or higher.
Overview
nodemailer is an Easy as cake e-mail sending from your Node.js applications
Affected versions of this package are vulnerable to Interpretation Conflict through _normalizeAddress in lib/mime-node/index.js. An attacker can cause mail to be delivered to an attacker-controlled domain by supplying a recipient address whose domain contains an IDN-mapped or ignored code point, such as an invisible soft hyphen, that a standards-compliant domain check resolves to a trusted domain but Nodemailer encodes to a different xn-- label. This can make an application approve or display one recipient domain while Nodemailer sends the message to another external domain, exposing the intended email content and breaking domain-based recipient controls.