CVE-2026-90776: Nodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsing
Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms to consume excessive CPU and block the Node.js event loop for several seconds, causing denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Mitigate denial of service by using an email gateway/WAF or similar upstream filtering to block or rate-limit incoming messages that contain RFC 5322 comments in the From/To/Cc address fields (comment-separated atoms) to prevent Node.js event-loop blocking.
Event History
Frequently Asked Questions
Which deployments are exposed to remote exploitation?
Deployments using Nodemailer 9.1.0 through 10.0.4 are exposed if an attacker can cause the application to parse attacker-controlled email headers. The issue is network-reachable and requires no privileges or user interaction.
What is the operational impact of a successful attack?
A crafted address containing RFC 5322 comment-separated atoms can consume excessive CPU during address parsing. This can block the Node.js event loop for several seconds and deny service to requests handled by that process.