CVE-2026-100700 — nodemailer before 10.0.6 Denial of Service via addressparser
nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking behavior. Attacker…
Published: 2026-09-26 · CVSS: 8.7 · CVSS 4.0
nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking behavior. Attackers can supply crafted email header values with long whitespace-free runs to block the Node.js event loop for tens of seconds, causing service unavailability.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7