CVE-2026-90776 in Nodemailer
Summary
by MITRE • 09/13/2026
Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms to consume excessive CPU and block the Node.js event loop for several seconds, causing denial of service.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/13/2026
The Nodemailer library, a widely used solution for sending emails in Node.js environments, contains a significant performance vulnerability within its address parsing component affecting versions 9.1.0 through 10.0.4. This flaw manifests as a quadratic time complexity issue when the parser processes email addresses that include RFC 5322 comments. The underlying technical mechanism involves an inefficient algorithmic approach to handling nested or complex comment structures within email headers. When an attacker crafts malicious email headers containing specifically designed comment-separated atoms, the parsing logic triggers excessive computational overhead. Instead of processing these inputs in linear time relative to input size, the complexity scales quadratically, meaning that even moderately sized malformed payloads can result in disproportionately high CPU consumption.
This vulnerability directly impacts the operational stability of applications relying on Nodemailer for email handling. Because Node.js operates on a single-threaded event loop model, any operation that consumes excessive CPU time without yielding control back to the event loop will block other asynchronous tasks. In this scenario, processing the maliciously crafted headers can block the event loop for several seconds. During this period, the application becomes unresponsive to incoming requests, effectively causing a denial of service condition. This is particularly dangerous in high-throughput environments where email parsing occurs frequently, as it can lead to cascading failures across dependent services or complete system paralysis depending on the volume and size of malicious inputs received.
From a classification perspective, this vulnerability aligns with CWE-400, which describes uncontrolled resource consumption leading to denial of service conditions. The attack vector leverages improper input validation and inefficient algorithmic design rather than memory corruption or injection flaws. In terms of adversary tactics, this behavior corresponds to the ATT&CK technique T1496, Resource Hijacking, where an attacker uses computing resources for their own benefit by causing excessive resource consumption that degrades service availability for legitimate users. The exploitation does not require authentication and can be triggered remotely if the application processes untrusted email headers or user-supplied address fields without adequate sanitization or complexity limits.
Mitigation strategies should focus on immediate version updates and defensive coding practices. Organizations using affected versions of Nodemailer must upgrade to a patched release that addresses the quadratic complexity issue in the address parser. Until an update is applied, developers can implement input validation layers that restrict the length and complexity of email header fields before they reach the parsing logic. Additionally, introducing timeouts or resource limits for string processing operations can help mitigate the impact by preventing any single operation from monopolizing the event loop indefinitely. Regular security audits focusing on third-party library dependencies are essential to identify similar algorithmic vulnerabilities in other components that handle untrusted text data.