Executive brief
nodemailer is a popular Node.js library used to send emails from applications. A flaw in its email address parsing logic allows attackers to craft malicious email headers that cause the application to freeze for tens of seconds, blocking all other operations and making the service unavailable. An attacker can exploit this remotely without authentication by providing specially crafted email header values.
Technical details
The addressparser module's free-text fallback regex pattern exhibits quadratic backtracking when processing email address headers containing long whitespace-free runs without a valid @ symbol. The vulnerable pattern rescans forward from each character offset to find an @ character, causing exponential CPU consumption (CWE-1333, CWE-407). Since Node.js is single-threaded, this blocks the entire process event loop. The vulnerability is reachable via inbound email headers in mailparser, or from user-supplied strings used as message addresses in mime-node.
Affected products
- nodemailer nodemailer before 10.0.6
Timeline
- 2026-09-11: disclosed
- 2026-09-26: patched: version 10.0.6 released