7.5Hoch
CVE-2026-90776Nodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsing
Beschreibung
Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms to consume excessive CPU and block the Node.js event loop for several seconds, causing denial of service.
Schwachstellentyp (CWE):
CWE-407
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| nodemailer | nodemailer | 9.1.0 – < 10.0.5, fixed 10.0.5 |
Referenzen und Patches
- GitHub Security Advisory (GHSA-prgh-xp8r-p3m5) vendor-advisory
- Patch Commit patch
- Vulnerable join check in addressparser at v10.0.4 technical-description
- nodemailer v10.0.5 Release Notes release-notes
- https://github.com/nodemailer/nodemailer product
- VulnCheck Advisory: Nodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsing third-party-advisory