CVE-2026-100700nodemailer before 10.0.6 Denial of Service via addressparser

Beschreibung

nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking behavior. Attackers can supply crafted email header values with long whitespace-free runs to block the Node.js event loop for tens of seconds, causing service unavailability.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• GitHub Security Advisory (GHSA-v53p-9fqp-m79j) vendor-advisory
• VulnCheck Advisory: nodemailer before 10.0.6 Denial of Service via addressparser third-party-advisory