CVE-2026-90776

Published: Sep 13, 2026Modified: Sep 24, 2026

8.7

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms to consume excessive CPU and block the Node.js event loop for several seconds, causing denial of service.

Related CWEs

Inefficient Algorithmic Complexity

An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

References (7)

https://github.com/nodemailer/nodemailer

Source: disclosure@vulncheck.com

https://github.com/nodemailer/nodemailer/blob/v10.0.4/src/addressparser/index.ts#L251

Source: disclosure@vulncheck.com

https://github.com/nodemailer/nodemailer/commit/c07f17518d25aca8ab2ad66968dcbca538c24b89

Source: disclosure@vulncheck.com

https://github.com/nodemailer/nodemailer/releases/tag/v10.0.5

Source: disclosure@vulncheck.com

https://github.com/nodemailer/nodemailer/security/advisories/GHSA-prgh-xp8r-p3m5

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/nodemailer-9.1.0-through-10.0.4-denial-of-service-via-quadratic-address-parsing

Source: disclosure@vulncheck.com

https://github.com/nodemailer/nodemailer/security/advisories/GHSA-prgh-xp8r-p3m5

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.