7.5Alta
CVE-2026-100700nodemailer before 10.0.6 Denial of Service via addressparser
Descripción
nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking behavior. Attackers can supply crafted email header values with long whitespace-free runs to block the Node.js event loop for tens of seconds, causing service unavailability.
Debilidad (CWE):
CWE-407
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| nodemailer | nodemailer | < 10.0.6, fixed 10.0.6 |
Referencias y parches
- GitHub Security Advisory (GHSA-v53p-9fqp-m79j) vendor-advisory
- VulnCheck Advisory: nodemailer before 10.0.6 Denial of Service via addressparser third-party-advisory