Nodemailer EUVD-2026-87673

Requires that the deploying application pass attacker-controllable email address or header values into nodemailer's addressparser (before version 10.0.6) - e.g., user-supplied recipient/sender fields, contact-form addresses, or inbound headers parsed via nodemailer. The malicious value must contain a long whitespace-free run to invoke the free-text fallback regex's quadratic backtracking. Limiting factors: impact is confined to blocking the Node.js event loop of the affected process (transient unavailability, not a crash or RCE); if the application never routes untrusted input into address parsing, the flaw is not reachable; upgrading to nodemailer 10.0.6 fully remediates.

This is a genuine but availability-only risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VA:H, all other impacts N) correctly frames it as a network-reachable, low-complexity, unauthenticated denial of service with no confidentiality or integrity impact - CWE-407 (inefficient algorithmic complexity / ReDoS) is consistent with this. The vendor's 8.7 score is driven entirely by VA:H plus the easy attack profile; there is no code execution or data exposure, so the real-world severity is lower than the raw number suggests. No EPSS score, no CISA KEV listing, and no public exploit are present in the provided data, so exploitation is unproven despite the theoretically easy vector. The important nuance the CVSS vector understates: nodemailer is a library, not a standalone service, so PR:N/AV:N only materializes if the consuming application feeds untrusted, attacker-controlled header/address input into the parser - a very common but not universal pattern. Impact is also a single-process event-loop stall (tens of seconds) rather than a persistent crash, which limits durable damage. Net: a real prioritization candidate for internet-facing Node.js mail-handling services, but not a critical drop-everything issue.

An attacker submits an email address or header value (e.g., via a web contact form, signup, or inbound mail relay that the application passes to nodemailer's addressparser) containing a long whitespace-free run engineered to trigger quadratic regex backtracking. Parsing this single value blocks the Node.js event loop for tens of seconds, stalling all concurrent requests on that process and denying service to legitimate users. No public exploit code is identified at time of analysis, but the payload is trivial to construct given the known ReDoS pattern.