CVE-2026-100700: nodemailer before 10.0.6 Denial of Service via addressparser
nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking behavior. Attackers can supply crafted email header values with long whitespace-free runs to block the Node.js event loop for tens of seconds, causing service unavailability.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using the npm nodemailer package before version 10.0.6 are affected. The issue is reachable when an attacker can supply crafted email header values that are processed by addressparser.
Does exploitation require authentication or user interaction?
No. The supplied severity vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction.
What is the operational impact of a successful attack?
A crafted header containing long whitespace-free runs can trigger quadratic regex backtracking. This can block the Node.js event loop for tens of seconds and make the service unavailable.
What can be done if an update cannot be applied immediately?
Limit or reject untrusted email header values containing unusually long whitespace-free runs before they reach nodemailer's address parsing functionality.