CVE-2026-100700

Name of the Vulnerable Software and Affected Versions nodemailer versions prior to 10.0.6

Description A denial of service issue exists in the addressparser free-text fallback regex pattern. The pattern exhibits quadratic backtracking, which occurs when a regular expression engine takes an exponential amount of time to process certain input strings. An attacker can exploit this by providing crafted email header values containing long whitespace-free runs, which blocks the Node.js event loop for tens of seconds and results in service unavailability.

Recommendations Update to version 10.0.6 or later.