CVE-2026-90776: Nodemailer DOS Vulnerability

CVE-2026-90776 Overview

CVE-2026-90776 is a denial-of-service vulnerability in Nodemailer, a widely deployed Node.js library for sending email. Versions 9.1.0 through 10.0.4 contain a quadratic time complexity flaw in the addressparser component. When the parser processes email addresses containing RFC 5322 comments, comment-separated atoms trigger nested rescans that scale non-linearly with input length. An attacker submitting crafted email headers can consume excessive CPU and block the Node.js event loop for several seconds per request. Because Node.js runs application logic on a single event loop, sustained requests halt all concurrent work in the process. The weakness is categorized under CWE-407: Inefficient Algorithmic Complexity.

Critical Impact
Remote, unauthenticated attackers can stall Node.js event loops and cause service-wide denial of service by sending crafted address headers to any endpoint that parses email addresses with Nodemailer.

Affected Products

Nodemailer versions 9.1.0 through 10.0.4
Node.js applications embedding the vulnerable addressparser module
Downstream frameworks and services that hand user-supplied email headers to Nodemailer

Discovery Timeline

2026-09-13 - CVE-2026-90776 published to NVD
2026-09-16 - Last updated in NVD database
Fix Released - Nodemailer v10.0.5 published with linear-time parser

Technical Details for CVE-2026-90776

Vulnerability Analysis

The defect lives in src/addressparser/index.ts inside the Nodemailer package. The parser walks tokens across an address string and classifies each run as text, address, comment, or group. When an input mixes atoms with RFC 5322 comments such as (foo)a(bar)b(baz)c, the pre-patch logic revisits prior tokens for each new comment boundary. That behavior produces O(n²) scaling on inputs where n is the count of comment-separated atoms.

A single header a few kilobytes long can therefore consume seconds of CPU on the main thread. Because Node.js processes HTTP requests, timers, and I/O callbacks on one event loop, the stall freezes the entire process. Any service that accepts inbound email headers, forwards contact form data, or validates recipient lists with Nodemailer is exposed to remote, unauthenticated abuse.

Root Cause

The address tokenizer did not carry state describing which section of the address it was currently accumulating. Repeated transitions between comment and atom states forced the parser to rescan prior segments. The fix introduces an explicit AddressPartsState type ('text' | 'address' | 'comment' | 'group') so each token is classified once in a single pass.

Attack Vector

Exploitation is network-based and requires no authentication or user interaction. An attacker submits a large address header composed of many short atoms separated by parenthesized comments to any application endpoint that forwards the value to Nodemailer's addressparser. Common exposure points include contact forms, SMTP relays, newsletter APIs, and helpdesk ingestion pipelines.

typescript

     textWasQuoted: boolean[];
 }
 
+/**
+ * The run of an address the token walk is collecting into at a given point
+ */
+type AddressPartsState = 'text' | 'address' | 'comment' | 'group';
+
 /**
  * Restores the quoting of a local part that was read out of a quoted string.
  *

Source: Nodemailer commit c07f175 — the patch introduces explicit parser state to collapse the quadratic walk into a single linear pass.

Detection Methods for CVE-2026-90776

Indicators of Compromise

Sustained 100% CPU on a single Node.js worker with the event loop lag metric spiking to multiple seconds.
HTTP request logs showing address, to, cc, bcc, or from fields containing repeated (comment)atom sequences.
Timeouts, 502, or 504 responses from services fronted by Nodemailer while inbound traffic remains low volume.

Detection Strategies

Instrument the Node.js runtime with perf_hooks.monitorEventLoopDelay() and alert when p99 delay exceeds a baseline for the process.
Add WAF or reverse-proxy rules that flag request bodies where email fields exceed a byte threshold or contain more than a small number of ( characters.
Review dependency inventories with npm ls nodemailer and flag any version between 9.1.0 and 10.0.4.

Monitoring Recommendations

Ship application CPU, event loop lag, and request latency metrics to a centralized analytics platform for correlation.
Track outbound 5xx spikes from mail-handling services and correlate against upstream request payload characteristics.
Enable structured logging for parsed recipient counts and header sizes so anomalous inputs are searchable after incident response.

How to Mitigate CVE-2026-90776

Immediate Actions Required

Upgrade Nodemailer to v10.0.5 or later across all Node.js services.
Audit direct and transitive dependencies with npm ls nodemailer and rebuild container images once patched.
Rate-limit and size-limit any endpoint that accepts user-controlled email address fields until the upgrade completes.

Patch Information

The upstream fix is documented in GitHub Security Advisory GHSA-prgh-xp8r-p3m5 and delivered through commit c07f175. The patch rewrites the addressparser walk with explicit state tracking, restoring linear parse time. Additional context is available in the VulnCheck advisory.

Workarounds

Reject inbound email address headers longer than a conservative byte limit (for example, 1 KB) at the ingress layer.
Strip or reject RFC 5322 comments from user-supplied addresses before invoking addressparser.
Offload email address parsing to a worker thread with a hard CPU time budget so a stalled parse cannot block the main event loop.

bash

# Upgrade Nodemailer and verify the resolved version
npm install nodemailer@^10.0.5
npm ls nodemailer

# Optional: audit for any remaining vulnerable ranges
npm audit --production