Executive brief
Nodemailer is a popular Node.js library for sending emails. Its address parser has a performance flaw that causes it to consume CPU exponentially when processing large numbers of email addresses. An attacker can supply a crafted recipient list (e.g., 200,000 addresses) that freezes the entire application for 25–30 seconds, blocking all other users and requests. No special configuration or authentication is required; the flaw triggers on any "send email" or "invite" feature that accepts user-supplied recipient lists.
Technical details
The vulnerability is a quadratic-time algorithmic defect in `lib/addressparser/index.js`. The parser accumulates parsed addresses using `Array.prototype.concat()` in a loop: `parsedAddresses = parsedAddresses.concat(handled)` on each iteration. Since `concat()` creates a new array with all prior elements copied, processing *n* addresses copies 1+2+3+…+n elements in total—O(n²) work. The root cause is not network-reachable; it is triggered whenever address parsing occurs, including on the direct `require('nodemailer/lib/addressparser')` API and on standard mail send paths (`transport.sendMail({ to: <user input> })`). No authentication is required. Three separate quadratic paths were identified and fixed in version 9.1.0: the main accumulator, a display-name merge loop using array splice, and recipient uniqueness checking via linear scan. Parsing now scales linearly; 200k addresses parse in ~80ms instead of ~25s.
Affected products
- Nodemailer Nodemailer < 9.1.0
Timeline
- 2026-09-08: disclosed: GitHub Advisory GHSA-2x7j-588g-ccc2 published
- 2026-09-01: patched: Fixed in nodemailer 9.1.0 with three separate commits: 9116da9 (addressparser concat), 7cc38af and 34da642 (MimeNode uniqueness check), 83b8c48 (concat.apply stack overflow)