CVE-2026-100700

HIGH 7.5

nodemailer before 10.0.6 Denial of Service via addressparser

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking behavior. Attackers can supply crafted email header values with long whitespace-free runs to block the Node.js event loop for tens of seconds, causing service unavailability.

CWE	CWE-407
Vendor	nodemailer
Product	nodemailer
Published	Sep 26, 2026

Stay Ahead of the Next One

Get instant alerts for nodemailer nodemailer

Be the first to know when new high vulnerabilities affecting nodemailer nodemailer are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

nodemailer / nodemailer

0 < 10.0.6

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/nodemailer/nodemailer/security/advisories/GHSA-v53p-9fqp-m79j vulncheck.com: https://www.vulncheck.com/advisories/nodemailer-before-10.0.6-denial-of-service-via-addressparser