CVE-2026-90776

EUVD-2026-77000
Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms to consume excessive CPU and block the Node.js event loop for several seconds, causing denial of service.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
nodemailernodemailer
9.1.0 ≤
𝑥
< 10.0.5
CNA
Debian logo
Debian Releases
Debian Product
Codename
node-nodemailer
bookworm
vulnerable
forky
vulnerable
sid
vulnerable
trixie
vulnerable
Common Weakness Enumeration
References
https://github.com/nodemailer/nodemailer
https://github.com/nodemailer/nodemailer/blob/v10.0.4/src/addressparser/index.ts#L251
https://github.com/nodemailer/nodemailer/commit/c07f17518d25aca8ab2ad66968dcbca538c24b89
https://github.com/nodemailer/nodemailer/releases/tag/v10.0.5
https://github.com/nodemailer/nodemailer/security/advisories/GHSA-prgh-xp8r-p3m5
https://www.vulncheck.com/advisories/nodemailer-9.1.0-through-10.0.4-denial-of-service-via-quadratic-address-parsing