CVE-2026-90776— Nodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsing
Quick assessment
Affected
nodemailer nodemailer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Nodemailer 9.1.0 至 10.0.4 版本中的地址解析器（addressparser）组件存在二次时间复杂度漏洞，在解析包含 RFC 5322 注释的电子邮件地址时触发。攻击者可以构造包含由注释分隔的原子（atoms）的恶意邮件头部，从而消耗大量 CPU 资源，导致 Node.js 事件循环被阻塞数秒，进而引发拒绝服务（DoS）攻击。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of ServiceAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| nodemailer | nodemailer | 9.1.0< 10.0.5 |
affected |
10.0.5 |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-90776
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Nodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsing
Source: CVE Program / CVE List V5
Vulnerability Description
Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms to consume excessive CPU and block the Node.js event loop for several seconds, causing denial of service.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
算法复杂性
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| nodemailer | nodemailer | 9.1.0 ~ 10.0.5 | - |
|
II. Public POCs for CVE-2026-90776
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-90776
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-90776 (1)
Vendor Advisories for CVE-2026-90776 (2)
Vendor Pages for CVE-2026-90776 (2)
-
🔗 Release v10.0.5 · nodemailer/nodemailer · GitHub release-notes
-
IV. Related Vulnerabilities
Same product: nodemailer
-
CVE-2026-82853
Nodemailer before 8.0.5 SMTP Command Injection via CRLF -
CVE-2026-82854
Nodemailer before 8.0.3 SMTP Command Injection via envelope. -
CVE-2026-82662
Nodemailer before 8.0.8 TLS Certificate Validation Bypass -
CVE-2026-82661
Nodemailer CRLF Injection via List-* Header Comments -
CVE-2026-82660
Nodemailer jsonTransport bypasses disableFileAccess and disa
Same vendor: nodemailer
-
CVE-2026-82854
Nodemailer before 8.0.3 SMTP Command Injection via envelope. -
CVE-2026-82853
Nodemailer before 8.0.5 SMTP Command Injection via CRLF -
CVE-2026-82662
Nodemailer before 8.0.8 TLS Certificate Validation Bypass -
CVE-2026-82661
Nodemailer CRLF Injection via List-* Header Comments -
CVE-2026-82660
Nodemailer jsonTransport bypasses disableFileAccess and disa
Same weakness: CWE-407
-
CVE-2026-86349
Mattermost Server Algorithmic DoS via Unbounded Markdown Blo -
CVE-2026-12882
Mattermost Markdown autolink parsing denial of service -
CVE-2026-87822
t-digest 3.1 through 3.3 Denial of Service via NaN Centroid -
CVE-2024-58382
league/commonmark before 2.6.0 Denial of Service via Quadrat -
CVE-2023-54395
PocketMine-MP before 4.12.5 Denial of Service via ModalFormR
V. Comments for CVE-2026-90776
No comments yet