GHSA-prgh-xp8r-p3m5: Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser)
(updated )
nodemailer/lib/addressparser parses one shape of address in O(n^2) time. A single ~640 KB address value blocks the Node.js event loop for roughly 7 seconds. And it is reachable without auth: mailparser feeds inbound email headers straight into this parser, so one crafted email is enough to stall a service that parses mail.
References
- github.com/advisories/GHSA-prgh-xp8r-p3m5
- github.com/nodemailer/nodemailer/commit/c07f17518d25aca8ab2ad66968dcbca538c24b89
- github.com/nodemailer/nodemailer/releases/tag/v10.0.5
- github.com/nodemailer/nodemailer/security/advisories/GHSA-prgh-xp8r-p3m5
- nvd.nist.gov/vuln/detail/CVE-2026-90776
- www.vulncheck.com/advisories/nodemailer-9.1.0-through-10.0.4-denial-of-service-via-quadratic-address-parsing
Code Behaviors & Features
Detect and mitigate GHSA-prgh-xp8r-p3m5 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →