7.5High
CVE-2026-90776Nodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsing
Description
Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms to consume excessive CPU and block the Node.js event loop for several seconds, causing denial of service.
Weakness (CWE):
CWE-407
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| nodemailer | nodemailer | 9.1.0 – < 10.0.5, fixed 10.0.5 |
References and patches
- GitHub Security Advisory (GHSA-prgh-xp8r-p3m5) vendor-advisory
- Patch Commit patch
- Vulnerable join check in addressparser at v10.0.4 technical-description
- nodemailer v10.0.5 Release Notes release-notes
- https://github.com/nodemailer/nodemailer product
- VulnCheck Advisory: Nodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsing third-party-advisory