# CVE-2026-90776

## Summary

- **CVE ID:** CVE-2026-90776
- **Severity:** HIGH
- **CVSS Score:** 8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N)
- **CWE:** CWE-407
- **Published:** Sep 13, 2026
- **Last Modified:** Sep 16, 2026

## Description

Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms to consume excessive CPU and block the Node.js event loop for several seconds, causing denial of service.

## Affected Products

- nodemailer — nodemailer (9.1.0)
- nodemailer — nodemailer (10.0.5)

## References

- [CNA](https://github.com/nodemailer/nodemailer/security/advisories/GHSA-prgh-xp8r-p3m5)
- [CNA](https://github.com/nodemailer/nodemailer/commit/c07f17518d25aca8ab2ad66968dcbca538c24b89)
- [CNA](https://github.com/nodemailer/nodemailer/blob/v10.0.4/src/addressparser/index.ts#L251)
- [CNA](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.5)
- [CNA](https://github.com/nodemailer/nodemailer)
- [CNA](https://www.vulncheck.com/advisories/nodemailer-9.1.0-through-10.0.4-denial-of-service-via-quadratic-address-parsing)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.48%
- **EPSS Percentile:** 40.3

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-18._