CVE-2026-90776

Nodemailer 9.1.0 through 10.0.4 contains a CWE-407 inefficient algorithmic complexity flaw in the addressparser component used to parse email addresses. An attacker triggers it by sending messages whose address headers contain crafted RFC 5322 comment-separated atoms, causing parsing time to grow quadratically with input size and pinning the CPU. Because Node.js is single-threaded, this blocks the event loop for several seconds per malicious header, degrading or exhausting availability of the affected service (CVSS 4.0: 8.7, availability-only impact, no privileges or user interaction required). Any Node.js application that uses an affected Nodemailer version to process attacker-controlled addresses or headers — such as inbound mail handling or address validation — is at risk. No public PoC exists, the flaw is not in CISA's KEV, and no exploitation in the wild is known.

What to do: Upgrade Nodemailer to a release newer than 10.0.4 as soon as a fixed version is published. Until then, cap the length of inbound address headers, strip or reject RFC 5322 comments before parsing, and rate-limit unauthenticated submission endpoints that feed addresses into Nodemailer. Consider moving address parsing into a worker thread or separate process so a malicious header cannot block the main event loop, and alert on CPU spikes or event-loop lag during mail processing.