Description

nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking behavior. Attackers can supply crafted email header values with long whitespace-free runs to block the Node.js event loop for tens of seconds, causing service unavailability.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-26T14:16:55.007Z",
  "pubdate": "2026-09-26T14:16:55.007Z",
  "executiveSummary": "Nodemailer versions prior to 10.0.6 are susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability located within the addressparser module's free-text fallback regex pattern.\nThe flaw stems from a non-optimized regular expression that exhibits quadratic backtracking behavior when processing specific, maliciously crafted inputs.\nAn unauthenticated remote attacker can exploit this vulnerability by providing email header values containing long, whitespace-free strings, effectively causing the Node.js event loop to block for extended periods.\nThis resource exhaustion prevents the application from processing legitimate requests, leading to a complete denial of service for the affected Node.js process.\nGiven that Nodemailer is a fundamental dependency for many email-sending applications, this vulnerability poses a significant risk to service availability and system stability.",
  "technicalDetails": "The root cause of this vulnerability is an inefficient regular expression pattern utilized by the addressparser component of Nodemailer for parsing free-text email address formats.\nThe problematic regex pattern fails to handle specific input structures efficiently, leading to catastrophic backtracking. In regular expression engines, catastrophic backtracking occurs when the engine attempts to match an input string that fails to conform to the pattern, but the pattern contains ambiguous sub-expressions that force the engine to explore an exponential number of permutations.\nIn the context of the addressparser module, the regex is designed to identify and extract email addresses from free-text headers. When an attacker provides an input consisting of an excessively long string without whitespace, the engine is forced to repeatedly backtrack as it attempts to evaluate the ambiguous segments of the regex.\nBecause Node.js operates on a single-threaded event loop architecture, the intensive computational overhead generated by this backtracking effectively halts the entire process. The CPU becomes saturated attempting to resolve the regex, preventing the event loop from processing any other incoming I/O operations, timers, or callbacks.\nExploitation is straightforward and does not require authentication or elevated privileges. An attacker simply needs to ensure that the target application processes a crafted email header, such as the 'From', 'To', or 'Cc' fields, containing the malicious payload.\nThe attack flow follows these steps: 1. The attacker identifies an application endpoint that accepts input destined for email header fields. 2. The attacker submits a crafted string characterized by long, continuous sequences of characters that do not contain white space. 3. The addressparser module attempts to parse this input, triggering the quadratic backtracking behavior in the regex engine. 4. The underlying Node.js process consumes 100% of a CPU core, blocking the event loop for several tens of seconds. 5. The application becomes unresponsive to all other users, resulting in a successful denial of service.\nThe vulnerability affects all versions of Nodemailer prior to 10.0.6. The impact is limited to denial of service; there is no documented evidence that this allows for remote code execution or unauthorized data access."
}