Is CVE-2026-100700 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100700 being exploited in the wild.

How severe is CVE-2026-100700?

High severity, with a CVSS score of 7.5, published 26 September 2026.

Which products and versions are affected?

Nodemailer before 10.0.6; nodemailer (npm) SEMVER:introduced=0,fixed=10.0.6.

Is there a fix for CVE-2026-100700?

Yes. nodemailer (npm): upgrade to 10.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-100700 attacked?

It is attacked over the network.

Am I affected by CVE-2026-100700?

Check whether you run Nodemailer or nodemailer (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100700: nodemailer addressparser regular expression denial of service

CVE-2026-100700 · Severity: high · CVSS 7.5 · Published 2026-09-26

nodemailer is a popular Node.js library used to send emails from applications. A flaw in its email address parsing logic allows attackers to craft malicious email headers that cause the application to freeze for tens of seconds, blocking all other operations and making the service unavailable. An attacker can exploit this remotely without authentication by providing specially crafted email header values.

Technologies: Nodemailer, nodemailer (npm). Vendors: Nodemailer, npm.

Quick answers

Is CVE-2026-100700 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100700 being exploited in the wild.
How severe is CVE-2026-100700?: High severity, with a CVSS score of 7.5, published 26 September 2026.
Which products and versions are affected?: Nodemailer before 10.0.6; nodemailer (npm) SEMVER:introduced=0,fixed=10.0.6.
Is there a fix for CVE-2026-100700?: Yes. nodemailer (npm): upgrade to 10.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-100700 attacked?: It is attacked over the network.
Am I affected by CVE-2026-100700?: Check whether you run Nodemailer or nodemailer (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

nodemailer (npm): upgrade to 10.0.6 or later
```
npm install nodemailer@10.0.6
```

Technical details

The addressparser module's free-text fallback regex pattern exhibits quadratic backtracking when processing email address headers containing long whitespace-free runs without a valid @ symbol. The vulnerable pattern rescans forward from each character offset to find an @ character, causing exponential CPU consumption (CWE-1333, CWE-407). Since Node.js is single-threaded, this blocks the entire process event loop. The vulnerability is reachable via inbound email headers in mailparser, or from user-supplied strings used as message addresses in mime-node.

Affected products

nodemailer nodemailer before 10.0.6

Identifiers

CVE-2026-100700
GHSA-v53p-9fqp-m79j

Timeline

2026-09-11: disclosed
2026-09-26: patched: version 10.0.6 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.