Nodemailer CVE-2026-92596

No special Nodemailer configuration is required - the quadratic parsing is on the library's default code path and triggers on any To/Cc/Bcc/From/Reply-To value or any string passed to the exported addressparser. The concrete prerequisite is application-side: the host application must pass attacker-influenced data into one of these address fields (e.g. user-supplied recipient lists, contact/invite forms). The practical limiter is that applications sending only to fixed or internally-controlled addresses are not exploitable, and impact is availability-only (event-loop starvation, 100% CPU) with no data exposure; a ~1.5 MB address string yields ~25-30 seconds of freeze, scaling with the square of input size.

This is a genuine, credible denial-of-service issue but not a top-tier incident-response priority absent active exploitation. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H, vendor 8.7) correctly captures a network-reachable, low-complexity, unauthenticated flaw with availability-only impact - no confidentiality or integrity loss (CWE-400). The high score is driven entirely by VA:H; there is no code-execution or data-exposure dimension, so it is a pure resource-exhaustion bug. No EPSS score, no CISA KEV listing, and no standalone weaponized exploit are present in the input, so exploitation status is 'no public exploit identified at time of analysis' - although the GHSA advisory publishes a measured reproduction methodology ('a@b.com,'.repeat(n) with a scaling table), which lowers the barrier to reproduce. The real-world limiter not reflected in the raw CVSS is a gating condition: the application must actually pass attacker-controlled data into a Nodemailer address field/header (or the exported addressparser). Apps that only send to fixed/internal addresses are not exposed; apps that parse user-submitted recipient lists (contact forms, invite systems, mailing tools) are directly exposed. Net: treat as a real but moderate patch-soon availability risk, elevated by Nodemailer's enormous deployment footprint, not a drop-everything emergency.

An attacker submits a single request to an application feature that forwards user-supplied recipient input into a Nodemailer address field (e.g. a 'send to these addresses' or contact/invite form), providing a multi-megabyte comma-separated address string. Nodemailer's addressparser accumulates results with Array.concat in O(n²), pinning one CPU core at 100% and blocking Node's single-threaded event loop for tens of seconds to minutes, freezing all other requests in that process. No authentication or exploit tooling is required; the GHSA advisory documents the exact input pattern and measured timings.