CVE-2026-92596 in Nodemailer
Summary
by MITRE • 09/17/2026
Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows remote attackers to cause denial of service by supplying a crafted comma-separated address list. Attackers can send a single email with a large number of addresses to block the Node.js event loop for extended periods, consuming 100% CPU and freezing the process.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in Nodemailer versions prior to 9.1.0 represents a significant security risk classified as a ReDoS or algorithmic complexity issue within its address parsing logic. Specifically, the flaw resides in the addressparser component which is responsible for processing email addresses provided by users before sending them via SMTP. The core technical deficiency involves a quadratic time complexity O(n^2) behavior when handling comma-separated lists of recipients. This means that as the number of addresses increases linearly, the computational effort required to parse and validate these addresses grows exponentially rather than proportionally. An attacker can exploit this by constructing an email message containing a meticulously crafted list of recipient addresses designed to trigger worst-case scenario parsing paths within the regular expression or string manipulation routines used by Nodemailer.
From an operational perspective, this vulnerability leads directly to a Denial of Service condition against the Node.js application utilizing the library. Because Node.js operates on a single-threaded event loop model, any operation that consumes excessive CPU time without yielding control back to the event loop will block all other asynchronous operations within the process. When an attacker submits a payload with a large number of addresses optimized for this quadratic complexity, the server's CPU usage spikes to one hundred percent as it attempts to parse the input. This effectively freezes the application, preventing it from handling legitimate requests, processing new emails, or responding to health checks. The impact is severe because it does not require authentication or complex exploitation chains; a single HTTP request containing the crafted email data can incapacitate the entire service instance for an extended period until the process crashes or is manually restarted.
This vulnerability aligns with CWE-400 Uncontrolled Resource Consumption, specifically highlighting how inefficient algorithmic complexity in input processing can lead to resource exhaustion. It also maps closely to MITRE ATT&CK technique T1499 Endpoint Denial of Service, where an adversary aims to degrade or disrupt the availability of a system by consuming critical resources such as CPU and memory. In cloud-native environments or serverless functions that rely on Nodemailer for transactional emails, this flaw can result in increased infrastructure costs due to prolonged execution times or complete service outages if auto-scaling policies are triggered incorrectly or if the instance becomes unresponsive.
Mitigation strategies must prioritize immediate upgrading of the Nodemailer dependency to version 9.1.0 or later where these quadratic complexity issues have been addressed through algorithmic optimizations and stricter input validation. For organizations unable to upgrade immediately, implementing a Web Application Firewall rule to limit the length of email header fields such as To, Cc, and Bcc can provide a temporary buffer against exploitation by rejecting payloads that exceed reasonable recipient counts or total character lengths. Additionally, developers should consider wrapping Nodemailer operations in timeout mechanisms or running them within isolated worker threads to prevent a single malicious request from blocking the main event loop of the Node.js application. Regular security audits focusing on input parsing libraries are essential to identify similar algorithmic vulnerabilities before they can be leveraged for denial-of-service attacks.