Advisory · CVE-2026-100700
nodemailer address parser can be wedged into a quadratic backtracking stall
nodemailer before 10.0.6 has a denial-of-service vulnerability in the addressparser free-text fallback regex, which exhibits quadratic backtracking. Crafted email header values with long whitespace-free runs can block the Node.js event loop for tens of seconds, taking the service down. Fixed in 10.0.6.
- Vendor
- nodemailer
- Product
- nodemailer
- Identifier / CWE
- CVE-2026-100700
CWE-407 - Action timing
- Immediate
Explain it like I’m five
The mail sorter reads an address one character at a time, but for a tricky address it keeps going back to the start and re-reading. A single weird address can keep the sorter busy for half a minute while the whole line of mail waits.
- 01Crafted header
The attacker supplies an email header value with a long whitespace-free run.
- 02Fallback regex
The addressparser free-text fallback regex attempts to parse it.
- 03Quadratic backtracking
The regex engine revisits earlier positions repeatedly, with cost growing quadratically in input length.
- 04Event loop blocked
The Node.js event loop stalls for tens of seconds per header, denying service.
What happened
nodemailer before 10.0.6 has a denial-of-service vulnerability in the addressparser free-text fallback regex, which exhibits quadratic backtracking (CVE-2026-100700, CVSS 8.7). Crafted email header values containing long whitespace-free runs force the regex engine into repeated backtracking, blocking the Node.js event loop for tens of seconds per header and taking the service down. Any path that parses attacker-influenced addresses, such as contact forms or inbound mail handling, is a trigger. The issue is fixed in nodemailer 10.0.6.
What to do
- Upgrade nodemailer to 10.0.6 or later.
- Bound the length of email header values accepted from untrusted input as defense in depth.
- Monitor event-loop lag on services that parse inbound addresses; stalls without CPU-heavy traffic are the signature.
Management note
nodemailer is one of the most depended-upon packages in the Node ecosystem, and ReDoS in a parser that touches inbound mail is about as reachable as it gets. The fix is a patch bump; the audit is checking which of your services parse untrusted headers.