CVE-2026-90776

HIGH 7.5

Nodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsing

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms to consume excessive CPU and block the Node.js event loop for several seconds, causing denial of service.

CWE	CWE-407
Vendor	nodemailer
Product	nodemailer
Published	Sep 13, 2026

Stay Ahead of the Next One

Get instant alerts for nodemailer nodemailer

Be the first to know when new high vulnerabilities affecting nodemailer nodemailer are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

nodemailer / nodemailer

9.1.0 < 10.0.5

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/nodemailer/nodemailer/security/advisories/GHSA-prgh-xp8r-p3m5 github.com: https://github.com/nodemailer/nodemailer/commit/c07f17518d25aca8ab2ad66968dcbca538c24b89 github.com: https://github.com/nodemailer/nodemailer/blob/v10.0.4/src/addressparser/index.ts#L251 github.com: https://github.com/nodemailer/nodemailer/releases/tag/v10.0.5 github.com: https://github.com/nodemailer/nodemailer vulncheck.com: https://www.vulncheck.com/advisories/nodemailer-9.1.0-through-10.0.4-denial-of-service-via-quadratic-address-parsing

Credits

🔍 mmadersbacher