CVE-2026-90776
Fixed in a distro release EPSS <1%CVSS 7.5
Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms to consume excessive CPU and block the Node.js event loop for several seconds, causing denial of service.
Products: nodemailer
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | nodemailer | 10.0.5 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | langfuse-4 | 4.50.0-r1 |
| Chainguard | langfuse-4-worker | 4.50.0-r1 |
| Chainguard | langfuse-fips-3 | 3.225.11-r2 |
| Chainguard | langfuse-fips-3-worker | 3.225.11-r2 |
| Chainguard | langfuse-fips-4 | 4.49.0-r2 |
| Chainguard | langfuse-fips-4-worker | 4.49.0-r2 |
| Chainguard | librechat | 0.8.7-r16 |
| Chainguard | unleash-fips | 8.2.0-r3 |
| Debian 12 | node-nodemailer | no fix |
| Debian 13 | node-nodemailer | no fix |
| Debian 14 | node-nodemailer | 10.0.10+~8.0.1-1 |
| Ubuntu 20.04 LTS | node-nodemailer | no fix |
| Ubuntu 22.04 LTS | node-nodemailer | no fix |
| Ubuntu 24.04 LTS | node-nodemailer | no fix |
| Ubuntu 26.04 LTS | node-nodemailer | no fix |
| Ubuntu 26.10 | node-nodemailer | no fix |