CVE-2026-100700 Denial of Service in Nodemailer

Nodemailer versions prior to 10.0.6 contain a Regular Expression Denial of Service (ReDoS) vulnerability in the addressparser component. The flaw exists within a free-text fallback regular expression pattern that exhibits quadratic backtracking behavior when processing specific input strings. By submitting crafted email header values containing long sequences of non-whitespace characters, an attacker can force the regex engine to enter a state of extreme computational complexity. Because Node.js operates on a single-threaded event loop, this excessive processing blocks the event loop for tens of seconds, rendering the affected application unresponsive and causing service unavailability. This vulnerability is particularly critical for applications that process user-supplied email data or headers without validation.

Impact

Successful exploitation results in a Denial of Service (DoS) condition, forcing the Node.js application to become unavailable by blocking its primary event loop. This can impact any service relying on Nodemailer for email processing or header parsing, potentially leading to widespread outages in applications that process external email inputs.

Recommendation

• Upgrade the nodemailer package to version 10.0.6 or later immediately to incorporate the fixed addressparser regex logic.
• Audit applications utilizing Nodemailer to identify input vectors where user-controlled email header data is passed to the library.
• Implement length constraints on all input strings that are subsequently passed to email header parsing functions to mitigate the risk of triggering catastrophic backtracking.