Is CVE-2026-92596 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-92596 being exploited in the wild.

How severe is CVE-2026-92596?

High severity, with a CVSS score of 7.5, published 16 September 2026.

Is there a fix for CVE-2026-92596?

A patch was published on 2026-09-01: Fix merged in nodemailer 9.1.0 (PR #1848) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-92596 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-92596?

Check whether you run Nodemailer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-92596: Nodemailer quadratic time complexity in address parser denial of service

CVE-2026-92596 · Severity: high · CVSS 7.5 · Published 2026-09-16

Nodemailer is a popular Node.js email library used by many applications to send messages. The address parser component contains an algorithmic flaw that allows attackers to freeze the application's event loop by sending an email with a crafted recipient list. A moderately-sized address list (1.5 MB) can stall the entire server for 25–30 seconds, blocking all other requests and operations.

Technologies: Nodemailer. Vendors: Nodemailer.

Quick answers

Is CVE-2026-92596 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-92596 being exploited in the wild.
How severe is CVE-2026-92596?: High severity, with a CVSS score of 7.5, published 16 September 2026.
Which products and versions are affected?: Nodemailer < 9.1.0.
Is there a fix for CVE-2026-92596?: A patch was published on 2026-09-01: Fix merged in nodemailer 9.1.0 (PR #1848) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-92596 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-92596?: Check whether you run Nodemailer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in lib/addressparser/index.js where parsed addresses are accumulated using Array.prototype.concat() on each iteration. For n addresses, this copies 1 + 2 + ... + n elements, resulting in O(n²) work and transient allocations. The parser is synchronous and blocks Node.js's single-threaded event loop for the entire parse duration. An attacker triggers this via sendMail({ to: <crafted string> }) or by directly calling the exported addressparser function. Three related quadratic paths were fixed: the addressparser concat loop, a display-name merge splice loop, and recipient deduplication in MimeNode#_convertAddresses. Additionally, [].concat.apply threw RangeError past ~124k recipients. Patched in version 9.1.0 by replacing concat() with in-place append (push.apply), which reduces 200k-address parsing from ~25 seconds to ~80 milliseconds. A new maxRecipients option (default 100,000) was introduced as a backstop.

Affected products

Nodemailer Nodemailer < 9.1.0

Identifiers

CVE-2026-92596
GHSA-2x7j-588g-ccc2

Timeline

2026-09-08: disclosed: GHSA-2x7j-588g-ccc2 and CVE-2026-92596 published
2026-09-01: patched: Fix merged in nodemailer 9.1.0 (PR #1848)
2026-09-08: kev added: Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.