Nodemailer Addressparser Denial of Service via CVE-2026-90776

Nodemailer versions 9.1.0 through 10.0.4 contain a vulnerability in the addressparser component that results in a quadratic time complexity condition when parsing email addresses containing RFC 5322 comments. An attacker can craft and submit specific email headers featuring deeply nested or complex comment-separated atoms. When the application attempts to process these headers, the addressparser library consumes excessive CPU cycles, effectively blocking the Node.js event loop for an extended period. Because Node.js operates on a single-threaded event loop, this resource exhaustion prevents the application from processing any other incoming requests, leading to a denial of service. This vulnerability is particularly critical for high-traffic mail servers or applications that rely on Nodemailer to ingest user-supplied email headers.

Impact

Successful exploitation results in a persistent denial of service condition for the targeted Node.js application. By sending a single crafted request or a low-volume stream of crafted headers, an attacker can cause legitimate application traffic to fail, potentially disrupting business-critical communication systems or automated email processing workflows. No data exfiltration is associated with this vulnerability, but the loss of availability can significantly impact services relying on Nodemailer.

Recommendation

Prioritized, concrete actions for development and security engineering teams:

• Upgrade Nodemailer to version 10.0.5 or later, which contains the fix for the quadratic parsing issue.
• Audit all applications utilizing Nodemailer to determine if user-controlled input is passed directly to email header fields processed by the library.
• Implement input validation and length limits on email header fields to prevent processing of excessively large or malformed strings if upgrading is not immediately possible.
• Monitor application logs for high CPU usage spikes or event loop blockages occurring concurrently with incoming email requests to identify potential exploitation attempts.