Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-92596— Nodemailer before 9.1.0 Denial of Service via addressparser

Quick assessment

Affected
nodemailer nodemailer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Nodemailer 在 9.1.0 之前的版本中，其 addressparser 组件存在二次时间复杂度漏洞。远程攻击者可通过构造特定的逗号分隔地址列表，向 Nodemailer 发送包含大量地址的单个邮件，从而导致拒绝服务。该攻击会导致 Node.js 事件循环被长期阻塞，使 CPU 占用率达到 100%，并导致进程冻结。

CVSS 7.5 · High EPSS 0.82% · P57

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 2

VendorProduct Version RangeStatus
nodemailer nodemailer < 9.1.0 affected
9.1.0 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-92596

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Nodemailer before 9.1.0 Denial of Service via addressparser
Source: CVE Program / CVE List V5
Vulnerability Description
Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows remote attackers to cause denial of service by supplying a crafted comma-separated address list. Attackers can send a single email with a large number of addresses to block the Node.js event loop for extended periods, consuming 100% CPU and freezing the process.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
nodemailer nodemailer 0 ~ 9.1.0 -

II. Public POCs for CVE-2026-92596

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-92596

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-92596 (3)

Vendor Advisories for CVE-2026-92596 (1)

Other References for CVE-2026-92596 (1)

Same Patch Batch · nodemailer · 2026-09-16 · 4 CVEs total

CVE-2026-92598 6.5 MEDIUM Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass
CVE-2026-92597 6.5 MEDIUM Nodemailer before 9.1.0 Email Domain Validation Bypass via RFC 5322 Comment
CVE-2026-92595 5.9 MEDIUM Nodemailer before 9.1.1 Security Sandbox Bypass via resolveContent

IV. Related Vulnerabilities

Same product: nodemailer
Same vendor: nodemailer
Same weakness: CWE-400