CVE-2026-92596 — Nodemailer before 9.1.0 Denial of Service via addressparser
Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows remote attackers to cause denial of service by supplying a …
Published: 2026-09-16 · CVSS: 8.7 · CVSS 4.0
Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows remote attackers to cause denial of service by supplying a crafted comma-separated address list. Attackers can send a single email with a large number of addresses to block the Node.js event loop for extended periods, consuming 100% CPU and freezing the process.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7