# CVE-2026-100700: nodemailer addressparser regular expression denial of service

Source: https://junglewise.ai/threats/cve-2026-100700-nodemailer-before-10-0-6-contains-a-denial-of-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-26. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-100700 · Severity: high · CVSS 7.5 · Published 2026-09-26

nodemailer is a popular Node.js library used to send emails from applications. A flaw in its email address parsing logic allows attackers to craft malicious email headers that cause the application to freeze for tens of seconds, blocking all other operations and making the service unavailable. An attacker can exploit this remotely without authentication by providing specially crafted email header values.

Technologies: [Nodemailer](https://junglewise.ai/threats/technologies/nodemailer), [nodemailer (npm)](https://junglewise.ai/threats/technologies/npm-nodemailer). Vendors: [Nodemailer](https://junglewise.ai/threats/vendors/nodemailer), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-100700 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100700 being exploited in the wild.

**How severe is CVE-2026-100700?** High severity, with a CVSS score of 7.5, published 26 September 2026.

**Which products and versions are affected?** Nodemailer before 10.0.6; nodemailer (npm) SEMVER:introduced=0,fixed=10.0.6.

**Is there a fix for CVE-2026-100700?** Yes. nodemailer (npm): upgrade to 10.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-100700 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-100700?** Check whether you run Nodemailer or nodemailer (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- nodemailer (npm): upgrade to 10.0.6 or later

  ```sh
  npm install nodemailer@10.0.6
  ```


## Technical details

The addressparser module's free-text fallback regex pattern exhibits quadratic backtracking when processing email address headers containing long whitespace-free runs without a valid @ symbol. The vulnerable pattern rescans forward from each character offset to find an @ character, causing exponential CPU consumption (CWE-1333, CWE-407). Since Node.js is single-threaded, this blocks the entire process event loop. The vulnerability is reachable via inbound email headers in mailparser, or from user-supplied strings used as message addresses in mime-node.

## Affected products

- nodemailer nodemailer before 10.0.6

## Identifiers

- CVE-2026-100700
- GHSA-v53p-9fqp-m79j

## Timeline

- 2026-09-11: disclosed
- 2026-09-26: patched: version 10.0.6 released

## References

- [https://github.com/nodemailer/nodemailer/security/advisories/GHSA-v53p-9fqp-m79j](https://github.com/nodemailer/nodemailer/security/advisories/GHSA-v53p-9fqp-m79j)
- [https://www.vulncheck.com/advisories/nodemailer-before-10.0.6-denial-of-service-via-addressparser](https://www.vulncheck.com/advisories/nodemailer-before-10.0.6-denial-of-service-via-addressparser)

## Related threats

- [Nodemailer address parsing bypass in addressparser](https://junglewise.ai/threats/cve-2026-125755-nodemailer-3-0-0-before-10-4-1-contains-an-address-parsing-flaw)
- [Nodemailer address parsing bypass in nested RFC 5322 comments](https://junglewise.ai/threats/cve-2026-121424-nodemailer-from-3-0-0-before-10-1-4-contains-an-address-parsing)
- [Nodemailer addressparser RFC 5322 comment parsing bypass](https://junglewise.ai/threats/nodemailer-a-nested-comment-ends-early-in-addressparser-releasing-the-4e80613c)
- [Nodemailer addressparser group terminator bypass in quoted strings](https://junglewise.ai/threats/nodemailer-a-inside-a-quoted-string-or-comment-ends-an-address-group-b8b045f9)
- [Nodemailer addressparser angle-addr parsing bypass](https://junglewise.ai/threats/nodemailer-a-inside-a-quoted-local-part-ends-an-angle-addr-early-in-28663cfb)