Junglewise Threat Intelligence

CVE-2026-92596: Nodemailer quadratic time complexity in address parser denial of service

CVE-2026-92596 · Severity: low · CVSS 3.1 · Published 2026-09-08

Executive brief

Nodemailer is a popular Node.js email library used by many applications to send messages. The address parser component contains an algorithmic flaw that allows attackers to freeze the application's event loop by sending an email with a crafted recipient list. A moderately-sized address list (1.5 MB) can stall the entire server for 25–30 seconds, blocking all other requests and operations.

Technical details

The vulnerability exists in lib/addressparser/index.js where parsed addresses are accumulated using Array.prototype.concat() on each iteration. For n addresses, this copies 1 + 2 + ... + n elements, resulting in O(n²) work and transient allocations. The parser is synchronous and blocks Node.js's single-threaded event loop for the entire parse duration. An attacker triggers this via sendMail({ to: <crafted string> }) or by directly calling the exported addressparser function. Three related quadratic paths were fixed: the addressparser concat loop, a display-name merge splice loop, and recipient deduplication in MimeNode#_convertAddresses. Additionally, [].concat.apply threw RangeError past ~124k recipients. Patched in version 9.1.0 by replacing concat() with in-place append (push.apply), which reduces 200k-address parsing from ~25 seconds to ~80 milliseconds. A new maxRecipients option (default 100,000) was introduced as a backstop.

Affected products

  • Nodemailer Nodemailer < 9.1.0

Timeline

  • 2026-09-08: disclosed: GHSA-2x7j-588g-ccc2 and CVE-2026-92596 published
  • 2026-09-01: patched: Fix merged in nodemailer 9.1.0 (PR #1848)
  • 2026-09-08: kev added: Advisory published

References

Related threats