Bug 2536015 (CVE-2026-92596) - CVE-2026-92596 nodemailer: Nodemailer: Denial of Service in addressparser component
Summary: CVE-2026-92596 nodemailer: Nodemailer: Denial of Service in addressparser com...
Keywords:
Status: NEW
Alias: CVE-2026-92596
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-17 13:38 UTC by OSIDB Bzimport
Modified: 2026-09-18 19:29 UTC (History)
20 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-09-17 13:38:12 UTC 
Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows remote attackers to cause denial of service by supplying a crafted comma-separated address list. Attackers can send a single email with a large number of addresses to block the Node.js event loop for extended periods, consuming 100% CPU and freezing the process.
Note You need to log in before you can comment on or make changes to this bug.