Nodemailer Sent Mail to the Wrong Domain: We Tested It (2026)

Nodemailer shipped 9.1.0 on 2026-08-31 and two advisories landed the next day. Both say a version of the same thing: the recipient domain your code checked is not the recipient domain nodemailer hands to the mail server.

We had a reason to care beyond the advisory. A week earlier we published a post about an Auth.js magic-link flaw and said plainly that nobody had tested whether nodemailer completes that attack chain. So we installed both versions and measured it.

What the two advisories say

Disclosed 2026-09-01, both CVSS 6.5 Moderate, both fixed in 9.1.0, neither carrying a CVE. Note that the GitHub Advisory Database only ingested them on 2026-09-08, so any tool reporting that later date is showing you the filing date rather than the disclosure.

GHSA-cc9r-2j5m-2m83, affecting >=6.9.16 <9.1.0. RFC 5322 permits comments in parentheses inside an address. When a closing parenthesis is immediately followed by a non-break character, nodemailer's parser sets noBreak = true and concatenates what follows onto the preceding token. So user@good-corp.com(x)evil.com becomes user@good-corp.comevil.com.

GHSA-wmmp-3585-3rmp, affecting <9.1.0. Nodemailer bundled a raw RFC 3492 punycode codec with no UTS-46 mapping, while browsers and Node's own url.domainToASCII do apply UTS-46. Put a soft hyphen (U+00AD) inside a domain and the two disagree about what domain it even is.

What we measured

Rather than trust the summaries, we installed nodemailer@9.0.0 and nodemailer@9.1.0 and sent through jsonTransport, which builds the real message and envelope without delivering it. The envelope is what matters. It's the address handed to the SMTP server, and it's the one the advisories are about.

const nodemailer = require('nodemailer');
const t = nodemailer.createTransport({ jsonTransport: true });

// U+00AD SOFT HYPHEN sits between "compa" and "ny"
const payloads = [
  'staff@company.com(x)evil.com',
  'staff@compa­ny.com',
];

for (const to of payloads) {
  const info = await t.sendMail({ from: 'app@example.com', to, subject: 'x', text: 'y' });
  console.log(to, '->', info.envelope.to);
}

Results, run 2026-09-09:

Both bugs reproduce exactly as described, and both are closed in 9.1.0. company.comevil.com and xn--company-pka.com are ordinary domains that anyone can register.

The finding the advisories do not mention

We also ran each payload past the three domain checks an app like this actually contains, to see which ones the attack gets past.

Read the first column. The comment payload is stopped by every check we tried, including the two crude ones, because the raw string genuinely does not end in @company.com. To be exploited, that bug needs a validator that parses RFC 5322 comments correctly and therefore agrees the domain is company.com, while nodemailer disagrees. That means a proper address-parsing library, not a string comparison.

Now the second column. The soft-hyphen payload walks past exactly one validator, and it's the good one. domainToASCII applies UTS-46, sees company.com, and approves. Nodemailer 9.0.0 then delivers to xn--company-pka.com.

About the Auth.js magic-link chain

Our post on the Auth.js magic-link homoglyph flaw said the attack needs the downstream mail sender to apply Unicode NFKC normalization, that the advisory named no sender that does, and that nobody had published results for nodemailer. We can close the nodemailer half now.

The payload is an address with a fullwidth commercial at, U+FF20, which NFKC folds into a real @. Send victim＠company.com@evil.com and a normalizing sender would turn it into victim@company.com plus a trailing @evil.com, changing which domain receives the mail.

nodemailer 9.0.0  envelope.to = ["victim＠company.com@evil.com"]
nodemailer 9.1.0  envelope.to = ["victim＠company.com@evil.com"]

The fullwidth character survives untouched in both versions. The domain stays evil.com, which is where the mail was always going, so nothing is redirected and nothing is gained. Nodemailer does not NFKC-normalize recipient addresses, so the Auth.js homoglyph attack does not complete through it.

That's a negative result and it's worth publishing precisely because it's negative. If you run Auth.js with the nodemailer provider, that particular chain is not your problem. Resend, SendGrid and Postmark remain untested, by us and by anyone else we can find.

What to do

Sources

Both advisories were ingested into the GitHub Advisory Database on 2026-09-08, a week after disclosure. We use the disclosure date throughout.