{"action":"Upgrade nodemailer to 9.1.0 or later.","affected":[{"fixed":"9.1.0","introduced":"6.9.16"}],"component":"nodemailer","cve_ids":["CVE-2026-92597"],"ecosystem":"npm","epss":0.00382,"exploited":false,"fixed_versions":["9.1.0"],"ghsa_id":"GHSA-cc9r-2j5m-2m83","id":"tcs_01M5KFJCB9313MFGY34QSXSMB1","modified_at":"2026-09-17T11:56:01.670395333Z","published_at":"2026-09-08T21:32:51Z","references":["https://osv.dev/vulnerability/GHSA-cc9r-2j5m-2m83","https://github.com/nodemailer/nodemailer/security/advisories/GHSA-cc9r-2j5m-2m83","https://github.com/nodemailer/nodemailer/pull/1848","https://github.com/nodemailer/nodemailer/commit/902b63e935435c30f4025901c0902dce64cd8880","https://github.com/nodemailer/nodemailer","https://github.com/nodemailer/nodemailer/releases/tag/v9.1.0"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-cc9r-2j5m-2m83","url":"https://osv.dev/vulnerability/GHSA-cc9r-2j5m-2m83"}],"summary":"Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain"}