CVE-2026-92596

Name of the Vulnerable Software and Affected Versions Nodemailer versions prior to 9.1.0

Description Nodemailer contains a quadratic time complexity issue in its addressparser component. When parsing a list of comma-separated addresses, the parser uses Array.prototype.concat to accumulate results, which causes the CPU consumption to grow proportionally to the square of the input length. This behavior blocks the single-threaded Node.js event loop, leading to 100% CPU usage and freezing the process, which results in a denial of service for all other requests.

This issue can be triggered via structured-address headers such as To, Cc, Bcc, From, or Reply-To, or by directly using the exported addressparser module. For example, an address value of approximately 1.5 MB can freeze the process for 25 to 30 seconds.

Recommendations Update Nodemailer to version 9.1.0 or later. As a temporary mitigation, restrict the length of user-supplied address strings or limit the number of recipients allowed in email headers before they are processed by the parser.