CVE-2026-90776
Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms to consume excessive CPU and block the Node.js event loop for several seconds, causing denial of service.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.7
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 0.48%
- CWE
- CWE-407
- Published
- 2026-09-13
- Last modified
- 2026-09-16
Affected products
- nodemailer nodemailer
- nodemailer nodemailer
Weakness type
Related vulnerabilities
- CVE-2022-36021 — Redis string pattern matching can be abused to achieve Denial of Service
- CVE-2026-34573 — Parse Server: GraphQL complexity validator exponential fragment traversal DoS
- CVE-2025-64460 — Potential denial-of-service vulnerability in XML serializer text extraction
- CVE-2025-64458 — Potential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows
- CVE-2026-1285 — Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods
- CVE-2025-14550 — Potential denial-of-service vulnerability via repeated headers when using ASGI
- CVE-2026-3276 — Potential DoS via quadratic complexity in unicodedata.normalize()
- CVE-2024-8233 — Inefficient Algorithmic Complexity in GitLab