Description

Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms to consume excessive CPU and block the Node.js event loop for several seconds, causing denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-13T12:17:16.547Z",
  "pubdate": "2026-09-13T12:17:16.547Z",
  "executiveSummary": "Nodemailer versions 9.1.0 through 10.0.4 are susceptible to a quadratic time complexity vulnerability within the addressparser component. The vulnerability is triggered by the improper processing of RFC 5322 formatted email address comments, which results in excessive CPU consumption. This flaw exposes the Node.js event loop to blocking conditions, effectively enabling a Denial of Service (DoS) attack. Because Node.js operates on a single-threaded event loop, the high computational overhead caused by parsing maliciously crafted headers renders the application unresponsive to legitimate traffic. The vulnerability can be exploited by remote, unauthenticated attackers who can influence email headers processed by the application. The impact is significant, as it allows for service degradation or total unavailability, posing a risk to any system relying on Nodemailer to process user-supplied email input.",
  "technicalDetails": "The vulnerability resides in the addressparser logic responsible for sanitizing and tokenizing email address headers according to RFC 5322 specifications. Specifically, the parser fails to implement linear time complexity constraints when handling nested or sequential comments enclosed in parentheses within the 'address' field. The root cause is a quadratic time complexity (O(n^2)) algorithmic flaw in the regex-based or iterative parsing logic that fails to terminate early or handle overlapping, deeply nested, or excessively repeated comment atoms.\nWhen a malicious payload containing an extensive sequence of comment-separated atoms is submitted, the addressparser enters an inefficient state of backtracking or repeated traversal. As the length of the crafted string increases, the CPU cycles required to parse the structure grow quadratically, leading to extended execution time. In the context of the Node.js runtime environment, this computation occurs on the main event loop thread.\nBecause Node.js is non-blocking and single-threaded by design, any synchronous operation that monopolizes CPU resources effectively pauses all other operations, including incoming network requests, database callbacks, and timers. An attacker exploits this by injecting a specially crafted header into the email input vector. Once the application passes this header to the addressparser function, the event loop becomes blocked for several seconds per malicious request. Repeatedly submitting these payloads leads to sustained service unavailability.\nThe vulnerability affects all Nodemailer deployments utilizing versions 9.1.0 through 10.0.4. Exploitation does not require authentication or elevated privileges, as the parser is typically invoked during the early stages of email composition or header validation, often before session-based security checks are applied. Network exposure is high if the application accepts input from untrusted sources, such as web contact forms, user-provided SMTP configurations, or email processing services that parse raw MIME headers. The post-exploitation state is defined by a high-latency or hung process, preventing the application from executing its primary email delivery functions, thereby creating a localized but highly effective Denial of Service condition."
}