{"action":"Upgrade nodemailer to 9.1.0 or later.","affected":[{"fixed":"9.1.0","introduced":"0"}],"component":"nodemailer","cve_ids":["CVE-2026-92598"],"ecosystem":"npm","epss":0.00395,"exploited":false,"fixed_versions":["9.1.0"],"ghsa_id":"GHSA-wmmp-3585-3rmp","id":"tcs_01M5KGFE98K311CXFWT80SQF9P","modified_at":"2026-09-17T11:56:00.274908066Z","published_at":"2026-09-08T21:33:32Z","references":["https://osv.dev/vulnerability/GHSA-wmmp-3585-3rmp","https://github.com/nodemailer/nodemailer/security/advisories/GHSA-wmmp-3585-3rmp","https://github.com/nodemailer/nodemailer/pull/1848","https://github.com/nodemailer/nodemailer/commit/259c32d7d266301e3377a212776c3fff993c0148","https://github.com/nodemailer/nodemailer/commit/b212ac4e27bce8182478044fcb8d1642ccdad46e","https://github.com/nodemailer/nodemailer","https://github.com/nodemailer/nodemailer/releases/tag/v9.1.0"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-wmmp-3585-3rmp","url":"https://osv.dev/vulnerability/GHSA-wmmp-3585-3rmp"}],"summary":"Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain"}