CVE-2026-90776

EPSS 0.48%
Veröffentlicht 13.09.2026 11:42:26
Zuletzt bearbeitet 24.09.2026 20:47:31
Erkennungen
Login

Nodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsing

Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms to consume excessive CPU and block the Node.js event loop for several seconds, causing denial of service.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 9

CNA 1 VulnDex Vulnerability Enrichment 1

Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).

Herstellernodemailer

≫

Produkt nodemailer

Default Statusunaffected

Version 9.1.0

Version < 10.0.5

Status affected

Version 10.0.5

Status unaffected

VulnDex Vulnerability Enrichment

Diese Information steht angemeldeten Benutzern zur Verfügung.

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.48%	0.4

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
disclosure@vulncheck.com	8.7	0	0	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
disclosure@vulncheck.com	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-407 Inefficient Algorithmic Complexity

An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

https://github.com/nodemailer/nodemailer

https://github.com/nodemailer/nodemailer/security/advisories/GHSA-prgh-xp8r-p3m5

https://github.com/nodemailer/nodemailer/commit/c07f17518d25aca8ab2ad66968dcbca538c24b89

https://github.com/nodemailer/nodemailer/blob/v10.0.4/src/addressparser/index.ts#L251

https://github.com/nodemailer/nodemailer/releases/tag/v10.0.5

https://www.vulncheck.com/advisories/nodemailer-9.1.0-through-10.0.4-denial-of-service-via-quadratic-address-parsing

https://nvd.nist.gov/vuln/detail/CVE-2026-90776

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2026-90776

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2026-90776

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2026-90776