CVE-2026-92596

Nodemailer before 9.1.0 contains an uncontrolled resource consumption flaw (CWE-400): a quadratic time-complexity algorithm in its addressparser component. A remote attacker can trigger it by supplying a crafted comma-separated address list — for example, sending a single email with a very large number of addresses that the application parses. The parsing stalls the Node.js event loop for extended periods, driving the process to 100% CPU and effectively freezing the entire application, yielding a denial of service with no confidentiality or integrity impact. Any Node.js service running a vulnerable Nodemailer version that parses attacker-controlled address lists (such as inbound email headers or user-supplied recipient lists) is affected. Exploitation has not been observed: the issue is not in CISA KEV and no public proof-of-concept is known.

What to do: Upgrade to Nodemailer 9.1.0 or later. Until patched, cap the number and length of addresses accepted per message, avoid passing untrusted email headers or user-supplied recipient lists into address parsing, and rate-limit or isolate email-parsing workloads (e.g., worker processes with hang detection/restart) so a stall cannot freeze the main service. Audit your codebase and dependencies to determine whether attacker-controlled input reaches Nodemailer's address parser.