CVE-2026-100700: Nodemailer DOS Vulnerability

CVE-2026-100700 Overview

CVE-2026-100700 is a denial of service vulnerability in nodemailer versions before 10.0.6. The flaw resides in the addressparser free-text fallback regex pattern, which exhibits quadratic backtracking behavior. Attackers can submit crafted email header values containing long whitespace-free character runs. These inputs force the regex engine into catastrophic backtracking, blocking the Node.js event loop for tens of seconds. Because Node.js uses a single-threaded event loop, the stalled worker cannot process other requests, resulting in service unavailability. The vulnerability is classified under CWE-407: Inefficient Algorithmic Complexity.

Critical Impact
Unauthenticated attackers can remotely stall the Node.js event loop and disrupt any service that passes untrusted email header values to the nodemailer address parser.

Affected Products

nodemailer versions prior to 10.0.6
Node.js applications invoking the addressparser module on untrusted input
Downstream services and SMTP relays embedding vulnerable nodemailer releases

Discovery Timeline

2026-09-26 - CVE-2026-100700 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-100700

Vulnerability Analysis

The vulnerability is a Regular Expression Denial of Service (ReDoS) within the addressparser component of nodemailer. When the parser cannot match a structured RFC 5322 address, it falls back to a free-text regex pattern. That pattern contains ambiguous quantifiers that produce quadratic time complexity on specific inputs. Supplying a long sequence without whitespace delimiters forces the regex engine to explore an exponential number of backtracking paths.

Because Node.js executes JavaScript on a single thread, the regex evaluation monopolizes the event loop. Pending HTTP requests, timers, and I/O callbacks queue behind the blocked worker. For services that parse From, To, Cc, or Reply-To headers from external messages, a single crafted message can produce multi-second to multi-minute stalls per request.

Root Cause

The root cause is an inefficient regular expression inside the addressparser free-text fallback branch. The pattern contains overlapping character classes that allow multiple derivations for the same input. On adversarial inputs — long runs of characters without separators — the regex engine performs quadratic backtracking rather than completing in linear time. Version 10.0.6 refactors the fallback matcher to eliminate the ambiguous quantifiers.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker submits an email, API request, or form field containing a malicious header value. Any downstream call to nodemailer's address parsing routines triggers the pathological regex. Common exposure points include inbound SMTP processors, webhook handlers, contact forms, and transactional mail services. See the GitHub Security Advisory GHSA-v53p-9fqp-m79j and the VulnCheck Advisory on Nodemailer for additional technical context.

No verified proof-of-concept code is published. The advisories describe the triggering input class as crafted header values containing extended whitespace-free runs.

Detection Methods for CVE-2026-100700

Indicators of Compromise

Node.js processes showing sustained 100% CPU on a single core without matching workload.
Event loop lag metrics spiking into the multi-second range during inbound mail processing.
HTTP or SMTP request latency growing from milliseconds to tens of seconds for endpoints that parse addresses.
Inbound messages containing unusually long whitespace-free strings in From, To, or Reply-To headers.

Detection Strategies

Inventory Node.js services using npm ls nodemailer and flag any version below 10.0.6.
Add event loop monitoring (for example, perf_hooks.monitorEventLoopDelay) and alert on sustained lag above 500 ms.
Review application logs for request timeouts correlated with mail-handling code paths.

Monitoring Recommendations

Export Node.js runtime metrics to a centralized observability pipeline and baseline event loop latency per service.
Capture inbound email headers at the perimeter mail gateway for retrospective analysis of suspicious patterns.
Correlate CPU saturation events with upstream request identifiers to isolate the malicious payload source.

How to Mitigate CVE-2026-100700

Immediate Actions Required

Upgrade nodemailer to version 10.0.6 or later across all applications and container images.
Rebuild and redeploy any service that bundles nodemailer as a transitive dependency.
Enforce maximum header length limits at the mail gateway and HTTP ingress tiers.
Place rate limits on endpoints that accept user-supplied email addresses.

Patch Information

The maintainers released a fix in nodemailer 10.0.6 that rewrites the vulnerable fallback regex in addressparser. Upgrade with npm install nodemailer@^10.0.6 or the equivalent package manager command. Verify the installed version with npm ls nodemailer after deployment. Refer to the GitHub Security Advisory for the official patch reference.

Workarounds

Pre-validate address header length and reject values exceeding a conservative threshold (for example, 320 characters per RFC 5321).
Reject header values containing contiguous non-whitespace runs longer than 128 characters before invoking the parser.
Offload address parsing to a worker thread with an execution timeout so stalls do not block the main event loop.
Place a Web Application Firewall rule in front of HTTP endpoints that forwards email data to nodemailer.

bash

# Configuration example
npm install nodemailer@^10.0.6
npm ls nodemailer