Nodemailer CVE-2026-90776

Exploitation requires that the target application runs Nodemailer versions 9.1.0-10.0.4 and passes attacker-controlled content into any code path that invokes the addressparser - this includes parsing incoming email headers (To, From, CC, Bcc, Reply-To) or accepting email address strings from user-submitted form data, API requests, or SMTP inbound traffic. No authentication is required and no non-default configuration is needed; the addressparser is invoked whenever Nodemailer processes an address string regardless of transport or mode. Applications that use Nodemailer exclusively to send outbound email to internally-validated, non-user-controlled addresses and never parse external input are not exposed. Exploitation is bounded to denial of service - there is no code execution or data disclosure impact.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) accurately captures that this vulnerability is network-reachable with no authentication, no interaction, and no special configuration - any Node.js application on Nodemailer 9.1.0-10.0.4 that parses attacker-controlled email addresses is exposed. The high availability impact is empirically grounded: the fix commit's test case demonstrates ~10 seconds of event-loop blockage from 1.5 MB of crafted input, and because Node.js is single-threaded, this freezes all concurrent request handling for the duration, not just the affected request. EPSS data was not included in the provided intelligence, so exploitation probability cannot be quantified numerically; however, the attack surface is broad and payload construction requires only string repetition. No public exploit code has been identified and the vulnerability does not appear in CISA KEV at time of analysis, which somewhat tempers urgency. Even so, a mid-sized municipal IT team in sopot running Node.js mail infrastructure on the affected version range should treat this as urgent, since the upgrade path to v10.0.5 is low-risk and the compensating-control alternatives (header-length limits at ingestion) carry their own trade-offs. There is no CVSS conflict to flag: the vector, description, and code evidence are internally consistent.

An attacker crafts an email address header value consisting of a base atom followed by hundreds of thousands of comment-separated atom repetitions (e.g., a@ concatenated with (c)b@ repeated 320,000 times, producing a ~1.5 MB string) and submits it to a contact form, SMTP inbound handler, or API endpoint backed by a Node.js application running Nodemailer 9.1.0-10.0.4. Nodemailer's addressparser processes the string in quadratic time, stalling the event loop for roughly 10 seconds; sending a small volume of such requests (a few per minute) is sufficient to sustain a denial-of-service condition that degrades all concurrent traffic handled by the server.