7.5High
CVE-2026-100700nodemailer before 10.0.6 Denial of Service via addressparser
Description
nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking behavior. Attackers can supply crafted email header values with long whitespace-free runs to block the Node.js event loop for tens of seconds, causing service unavailability.
Weakness (CWE):
CWE-407
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| nodemailer | nodemailer | < 10.0.6, fixed 10.0.6 |
References and patches
- GitHub Security Advisory (GHSA-v53p-9fqp-m79j) vendor-advisory
- VulnCheck Advisory: nodemailer before 10.0.6 Denial of Service via addressparser third-party-advisory