7.5Alta
CVE-2026-90776Nodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsing
Descripción
Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms to consume excessive CPU and block the Node.js event loop for several seconds, causing denial of service.
Debilidad (CWE):
CWE-407
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| nodemailer | nodemailer | 9.1.0 – < 10.0.5, fixed 10.0.5 |
Referencias y parches
- GitHub Security Advisory (GHSA-prgh-xp8r-p3m5) vendor-advisory
- Patch Commit patch
- Vulnerable join check in addressparser at v10.0.4 technical-description
- nodemailer v10.0.5 Release Notes release-notes
- https://github.com/nodemailer/nodemailer product
- VulnCheck Advisory: Nodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsing third-party-advisory