Executive brief
Nodemailer is a popular Node.js library for sending emails. Versions 9.1.0 through 10.0.4 contain a performance flaw in email address parsing that allows attackers to crash or severely slow down applications by sending specially crafted email headers, causing service disruption and potential denial of service attacks.
Technical details
The vulnerability is a quadratic time complexity (ReDoS-like) flaw in the addressparser component when processing RFC 5322 comments in email addresses. An attacker can craft malicious email headers with nested or repeated comment-separated atoms that trigger the quadratic parsing behavior, consuming excessive CPU and blocking the Node.js event loop for several seconds. This is a network-accessible vulnerability triggered during email address parsing. The vulnerability affects Nodemailer versions 9.1.0 through 10.0.4; users should upgrade to a patched version when available.
Affected products
- Nodemailer Nodemailer 9.1.0 through 10.0.4
Timeline
- 2026-09-13: disclosed