Mmadersbacher

**Name of the Vulnerable Software and Affected Versions** Nodemailer versions 9.1.0 through 10.0.4 **Description** The `addressparser` component contains an algorithmic complexity issue when parsing email addresses that include RFC 5322 comments. A remote attacker can craft malicious email headers using comment-separated atoms to trigger quadratic time complexity, which consumes excessive CPU resources and blocks the Node.js event loop for several seconds, resulting in a denial of service. **Recommendations** Update to version 10.0.5 or later.