7.5Yüksek
CVE-2026-90776Nodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsing
Açıklama
Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms to consume excessive CPU and block the Node.js event loop for several seconds, causing denial of service.
Zayıflık türü (CWE):
CWE-407
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| nodemailer | nodemailer | 9.1.0 – < 10.0.5, fixed 10.0.5 |
Kaynaklar ve yamalar
- GitHub Security Advisory (GHSA-prgh-xp8r-p3m5) vendor-advisory
- Patch Commit patch
- Vulnerable join check in addressparser at v10.0.4 technical-description
- nodemailer v10.0.5 Release Notes release-notes
- https://github.com/nodemailer/nodemailer product
- VulnCheck Advisory: Nodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsing third-party-advisory