Login Request a demo
High severity · published Sep 13, 2026
CVE-2026-90776
Nodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsing
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms to consume excessive CPU and block the Node.js event loop for several seconds, causing denial of service.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NO
nodemailer · nodemailer
9.1.0 before 10.0.5 · source: vendor
Affected product
NO
nodemailer
nodemailer
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-90776
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-90776
github.com
https://github.com/nodemailer/nodemailer
github.com
https://github.com/nodemailer/nodemailer/blob/v10.0.4/src/addressparser/index.ts#L251
github.com
https://github.com/nodemailer/nodemailer/commit/c07f17518d25aca8ab2ad66968dcbca538c24b89
github.com
https://github.com/nodemailer/nodemailer/releases/tag/v10.0.5
github.com
https://github.com/nodemailer/nodemailer/security/advisories/GHSA-prgh-xp8r-p3m5
www.vulncheck.com
https://www.vulncheck.com/advisories/nodemailer-9.1.0-through-10.0.4-denial-of-service-via-quadratic-address-parsing
More from nodemailer
9.8
CVE-2026-82854
Nodemailer before 8.0.4 SMTP Command Injection via envelope.size
9.8
CVE-2020-7769
This affects the package nodemailer before 6.4.16
8.8
CVE-2021-23400
The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address…
7.5
CVE-2026-110869
Nodemailer 3.0.0 before 10.0.13 ReDoS via SMTP AUTH Mechanism Detection Regexes
7.5
CVE-2026-100700
nodemailer before 10.0.6 Denial of Service via addressparser