CVE-2026-92596: Nodemailer DOS Vulnerability

CVE-2026-92596 Overview

CVE-2026-92596 is a denial of service vulnerability in Nodemailer versions before 9.1.0. The flaw resides in the addressparser component, which exhibits quadratic time complexity when processing comma-separated address lists. Remote attackers can supply a crafted email with a large number of recipient addresses to block the Node.js event loop for extended periods. The affected process consumes 100% CPU and freezes, preventing it from handling any other requests. The vulnerability is classified under CWE-400: Uncontrolled Resource Consumption.

Critical Impact
A single crafted email containing a large recipient list can freeze a Nodemailer-based service, halting all outbound mail processing and denying service to legitimate users.

Affected Products

Nodemailer versions prior to 9.1.0
Node.js applications embedding vulnerable Nodemailer releases
Server-side mail dispatch services and SMTP relays built on Nodemailer

Discovery Timeline

2026-09-16 - CVE-2026-92596 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-92596

Vulnerability Analysis

The vulnerability stems from an algorithmic complexity flaw in Nodemailer's address handling pipeline. When Nodemailer converts recipient addresses in _convertAddresses, it deduplicates entries by scanning the growing uniqueList array for each new address. This linear membership check inside a per-address loop produces O(n²) behavior for a single header. A separate defect in _parseAddresses used Array.prototype.concat.apply to flatten parsed addresses, which throws a RangeError once the recipient array exceeds the JavaScript engine's function-argument limit. Combined, these issues let a single crafted address list saturate CPU or crash the sending path.

Root Cause

The root cause is the absence of a constant-time membership structure during recipient deduplication in lib/mime-node/index.js. Each new address triggered a full scan of the accumulated list. State was not shared across the To, Cc, and Bcc headers, compounding the cost. The parser also relied on concat.apply for flattening, which does not scale to large arrays.

Attack Vector

The attack requires no authentication or user interaction. A remote attacker submits a single message whose address header contains a large comma-separated recipient list to any interface that hands input to Nodemailer. Parsing the crafted list blocks the Node.js event loop, driving CPU to 100% and stalling the process for all other requests.

javascript

// Patch: introduce a shared Set to dedupe recipients in linear time
// Source: https://github.com/nodemailer/nodemailer/commit/7cc38af
_convertAddresses(addresses, uniqueList, seenAddresses) {
    const values = [];

    uniqueList = uniqueList || [];

    // Membership is checked once per address, so scanning uniqueList itself would make
    // a recipient list cost O(n^2). Groups recurse with the same set so that a nested
    // group still dedupes against the addresses collected around it, and a caller that
    // passes a partly filled list (To, then Cc, then Bcc) keeps deduping across headers.
    if (!seenAddresses) {
        seenAddresses = new Set();
        for (let i = 0; i < uniqueList.length; i++) {
            seenAddresses.add(uniqueList[i].address);
        }
    }

    [].concat(addresses || []).forEach(address => {
        if (address.address) {
            address.address = this._normalizeAddress(address.address);

A companion patch in commit 83b8c48 replaces concat.apply with an explicit forEach loop that appends into a preallocated array, avoiding the RangeError triggered by long Bcc lists.

Detection Methods for CVE-2026-92596

Indicators of Compromise

Sustained 100% CPU utilization on a single Node.js worker handling mail traffic
Blocked event loop lag metrics rising into seconds or minutes during message submission
Inbound API requests or SMTP submissions containing address headers with unusually large comma-separated recipient counts
RangeError: Maximum call stack size exceeded or argument-limit errors originating in lib/mime-node/index.js

Detection Strategies

Inventory application dependencies and flag any nodemailer version below 9.1.0 in package.json or package-lock.json
Instrument mail submission endpoints with request size and recipient count validation, and alert on outliers
Enable Node.js event loop lag monitoring (for example, perf_hooks or event-loop-lag) and alert when lag exceeds a defined threshold
Correlate CPU spikes on mail worker processes with the source IP or authenticated user that submitted the triggering payload

Monitoring Recommendations

Track process-level CPU and event loop delay for services embedding Nodemailer
Log the recipient count of every outbound message and retain the values for anomaly detection
Forward application logs and process metrics to a centralized analytics platform for correlation with abuse patterns
Review web application firewall and API gateway telemetry for oversized message bodies targeting mail endpoints

How to Mitigate CVE-2026-92596

Immediate Actions Required

Upgrade Nodemailer to version 9.1.0 or later in all applications and container images
Enforce a hard cap on the number of recipients accepted per message at the application layer
Add request body size limits on any HTTP endpoint that forwards data into Nodemailer
Restrict unauthenticated access to mail submission endpoints where feasible

Patch Information

The fix ships in Nodemailer 9.1.0. See the GitHub Security Advisory GHSA-2x7j-588g-ccc2 and the VulnCheck advisory for full details. Relevant commits include 34da642, 7cc38af, 83b8c48, and 9116da9. Together they add a shared Set for linear-time recipient deduplication and replace concat.apply with an explicit accumulator.

Workarounds

Validate and reject inbound requests whose recipient headers exceed a conservative count, for example 100 addresses
Run Nodemailer inside a dedicated worker process or container with strict CPU limits to contain event loop stalls
Add rate limiting and authentication to mail submission APIs to reduce anonymous abuse surface
Terminate long-running mail processing tasks with a watchdog timer to release blocked workers

bash

# Update Nodemailer to the patched release
npm install nodemailer@^9.1.0

# Confirm the installed version
npm ls nodemailer

# Audit for known advisories in the dependency tree
npm audit --production