CVE-2026-100700 in Nodemailer
Summary
by MITRE • 09/26/2026
nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking behavior. Attackers can supply crafted email header values with long whitespace-free runs to block the Node.js event loop for tens of seconds, causing service unavailability.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/26/2026
The identified vulnerability resides within the nodemailer library prior to version 10.0.6 and specifically targets the address parser component when processing free-text fallback scenarios. This flaw is characterized by a regular expression pattern that exhibits quadratic backtracking behavior, a classic algorithmic complexity issue where the execution time grows exponentially relative to the length of certain input strings. When an attacker supplies crafted email header values containing long runs of whitespace-free characters, the regex engine engages in excessive computational effort attempting to match or reject these patterns. This results in significant resource consumption that blocks the Node.js event loop for tens of seconds, effectively causing a denial of service condition where legitimate requests cannot be processed and the application becomes unresponsive.
From a technical perspective, this vulnerability aligns with Common Weakness Enumeration category CWE-400, which describes Uncontrolled Resource Consumption due to regular expression complexity. The underlying mechanism involves catastrophic backtracking, where the regex engine explores an exponential number of possible paths before determining that no match exists or completing a complex match operation. In the context of Node.js applications, which rely on a single-threaded event loop for handling asynchronous operations, blocking this thread with long-running computations prevents other I/O events from being processed. This creates a situation where even if the application is designed to handle high concurrency through non-blocking I/O, it becomes effectively serialized and unresponsive due to CPU-bound regex processing that monopolizes the execution context.
The operational impact of this vulnerability extends beyond simple performance degradation. By exploiting this flaw, an attacker can cause service unavailability without requiring authentication or elevated privileges if the vulnerable code path is exposed via standard email parsing functions such as address normalization or header validation. This constitutes a significant availability risk for any application relying on nodemailer to process incoming emails or validate sender addresses. The attack vector typically involves injecting specially crafted strings into fields that are parsed by the library, potentially through SMTP headers, message bodies, or configuration inputs depending on how the library is integrated into the broader email processing pipeline.
To mitigate this vulnerability, organizations must upgrade nodemailer to version 10.0.6 or later where the regular expression patterns have been optimized to prevent quadratic backtracking and ensure linear time complexity for input validation. In environments where immediate patching is not feasible, defensive coding practices should be implemented to limit the length of inputs passed to email parsing functions. Additionally, deploying a Web Application Firewall with rules capable of detecting regex-based denial-of-service attempts can provide an additional layer of protection by blocking requests containing suspiciously long strings in relevant headers or parameters. Monitoring for unusual spikes in CPU usage associated with Node.js processes can also serve as an early detection mechanism for such attacks.
This incident highlights the importance of rigorous input validation and secure coding practices when integrating third-party libraries that handle untrusted data. It reinforces the need to audit regular expressions used in security-critical paths, particularly those processing external inputs like email addresses or headers. Adhering to industry standards such as OWASP guidelines for preventing resource exhaustion attacks is essential. Furthermore, maintaining an up-to-date software bill of materials and regularly updating dependencies ensures that known vulnerabilities with significant availability impacts are addressed promptly, thereby preserving the integrity and reliability of email-dependent services.