p PatchFirst

CVE-2026-90776

CVE-2026-90776 · Nodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsing

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms to consume excessive CPU and block the Node.js event loop for several seconds, causing denial of service.

CVSS 8.7 · High · EPSS 0.7% · Public exploit · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • nodemailer

    Versions
    • ≥ 9.1.0, < 10.0.5: Affected (semver)
    • 10.0.5: Not affected (semver)

    Update to 10.0.5

  • node-nodemailer Debian:12

    Versions
    • 10.0.0+~8.0.1-1
    • 10.0.10+~8.0.1-1
    • 6.10.0+~6.4.17-1
    • 6.8.0+~6.4.6-1
    • 6.9.13+~6.4.14-1
    • 6.9.15+~6.4.16-1
    • 6.9.16+~6.4.16-1
    • 6.9.4+~6.4.9-1
    • 6.9.4+~6.4.9-2
    • 6.9.4+~6.4.9-3
    • 6.9.4+~6.4.9-4
    • 7.0.10+~7.0.2-1
    • 7.0.12+~7.0.5-1
    • 7.0.5+~7.0.1-1
    • 7.0.6+~7.0.1-1
    • 7.0.9+~7.0.2-1
    • 7.0.9+~7.0.2-2
    • 8.0.11+~8.0.1-1
    • 8.0.2+~7.0.11-1
    • 8.0.3+~7.0.11-1
    • 8.0.4+~7.0.11-1
    • 8.0.4+~7.0.11-2
    • 9.0.0+~8.0.1-1
    • 9.0.3+~8.0.1-1
    • 9.0.5+~8.0.1-1
    • 9.0.6+~8.0.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-nodemailer Debian:13

    Versions
    • 10.0.0+~8.0.1-1
    • 10.0.10+~8.0.1-1
    • 6.10.0+~6.4.17-1
    • 6.10.0+~6.4.17-1+deb13u1
    • 7.0.10+~7.0.2-1
    • 7.0.12+~7.0.5-1
    • 7.0.5+~7.0.1-1
    • 7.0.6+~7.0.1-1
    • 7.0.9+~7.0.2-1
    • 7.0.9+~7.0.2-2
    • 8.0.11+~8.0.1-1
    • 8.0.2+~7.0.11-1
    • 8.0.3+~7.0.11-1
    • 8.0.4+~7.0.11-1
    • 8.0.4+~7.0.11-2
    • 9.0.0+~8.0.1-1
    • 9.0.3+~8.0.1-1
    • 9.0.5+~8.0.1-1
    • 9.0.6+~8.0.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-nodemailer Debian:14

    Versions
    • 10.0.0+~8.0.1-1
    • 6.10.0+~6.4.17-1
    • 7.0.10+~7.0.2-1
    • 7.0.12+~7.0.5-1
    • 7.0.5+~7.0.1-1
    • 7.0.6+~7.0.1-1
    • 7.0.9+~7.0.2-1
    • 7.0.9+~7.0.2-2
    • 8.0.11+~8.0.1-1
    • 8.0.2+~7.0.11-1
    • 8.0.3+~7.0.11-1
    • 8.0.4+~7.0.11-1
    • 8.0.4+~7.0.11-2
    • 9.0.0+~8.0.1-1
    • 9.0.3+~8.0.1-1
    • 9.0.5+~8.0.1-1
    • 9.0.6+~8.0.1-1
    Affected ranges
    • ECOSYSTEM: < 10.0.10+~8.0.1-1

    Update to 10.0.10+~8.0.1-1

  • nodemailer npm

    Affected ranges
    • SEMVER: ≥ 9.1.0, < 10.0.5

    Update to 10.0.5

  • node-nodemailer Ubuntu:20.04:LTS

    Versions
    • 6.3.0-2
    • 6.3.1-1
    • 6.4.0-1
    • 6.4.1-1
    • 6.4.2-1
    • 6.4.5-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-nodemailer Ubuntu:22.04:LTS

    Versions
    • 6.4.17-3
    • 6.7.0-1
    • 6.7.0-2
    • 6.7.1+~6.4.4-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-nodemailer Ubuntu:24.04:LTS

    Versions
    • 6.9.4+~6.4.9-2
    • 6.9.4+~6.4.9-3ubuntu1
    • 6.9.4+~6.4.9-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-nodemailer Ubuntu:26.10

    Versions
    • 8.0.4+~7.0.11-1
    • 8.0.4+~7.0.11-2
    • 9.0.0+~8.0.1-1
    • 9.0.3+~8.0.1-1
    • 9.0.5+~8.0.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-nodemailer Ubuntu:26.04:LTS

    Versions
    • 7.0.5+~7.0.1-1
    • 7.0.9+~7.0.2-2
    • 7.0.10+~7.0.2-1
    • 7.0.12+~7.0.5-1
    • 8.0.4+~7.0.11-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →