7.5Yüksek
CVE-2026-100700nodemailer before 10.0.6 Denial of Service via addressparser
Açıklama
nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking behavior. Attackers can supply crafted email header values with long whitespace-free runs to block the Node.js event loop for tens of seconds, causing service unavailability.
Zayıflık türü (CWE):
CWE-407
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| nodemailer | nodemailer | < 10.0.6, fixed 10.0.6 |
Kaynaklar ve yamalar
- GitHub Security Advisory (GHSA-v53p-9fqp-m79j) vendor-advisory
- VulnCheck Advisory: nodemailer before 10.0.6 Denial of Service via addressparser third-party-advisory