CVE-2026-100700: nodemailer before 10.0.6 Denial of Service via addressparser

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-26 · updated 2026-09-30
Weakness: CWE-407

Description

nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking behavior. Attackers can supply crafted email header values with long whitespace-free runs to block the Node.js event loop for tens of seconds, causing service unavailability.

Affected products

nodemailer: before 10.0.6 — fixed in 10.0.6

How to fix

Upgrade to a fixed version: nodemailer 10.0.6. Check the vendor advisory for mitigations.

References

https://github.com/nodemailer/nodemailer/security/advisories/GHSA-v53p-9fqp-m79j
https://www.vulncheck.com/advisories/nodemailer-before-10.0.6-denial-of-service-via-addressparser
https://github.com/nodemailer/nodemailer/security/advisories/GHSA-v53p-9fqp-m79j

Get alerted when CVE-2026-100700 or the next vulnerability affects your stack