Bug 2532697 (CVE-2026-90776)

Summary: CVE-2026-90776 nodemailer: Nodemailer: Denial of Service via crafted email headers
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: abarbaro, alizardo, dschmidt, jchui, jhe, jlanda, kaycoth, kshier, ktsao, lchilton, nboldt, oaljalju, psrna, rhel-process-autobot, sfeifer, simaishi, stcannon, teagle, watson-tool-maintainers, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Nodemailer's addressparser component. A remote attacker can exploit this by crafting malicious email headers containing specially formatted comments. This can lead to excessive CPU consumption and block the Node.js event loop, resulting in a denial of service for the application.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-13 11:51:25 UTC
Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms to consume excessive CPU and block the Node.js event loop for several seconds, causing denial of service.