{"id":"CVE-2026-100700","revision":null,"records":[{"revision":"eb9cc948b9264f6b85d020e5f00e2d68","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-100700","aliases":[],"title":"nodemailer before 10.0.6 Denial of Service via addressparser","description":"nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking behavior. Attackers can supply crafted email header values with long whitespace-free runs to block the Node.js event loop for tens of seconds, causing service unavailability.","state":0,"publishedAt":"2026-09-26T13:23:56.526+00:00","modifiedAt":"2026-09-28T15:01:54.036+00:00","affected":[{"ecosystem":"Vendor product","name":"nodemailer","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"nodemailer\",\n                    \"product\": \"nodemailer\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:npm/nodemailer\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"10.0.6\"\n                        },\n                        {\n                            \"version\": \"10.0.6\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":8.7,"severity":"HIGH"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-v53p-9fqp-m79j","https://www.vulncheck.com/advisories/nodemailer-before-10.0.6-denial-of-service-via-addressparser"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-100700","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-100700","identifiers":["CVE-2026-100700"]},"retained":false,"historicalAffected":[]},{"revision":"eb3f8717319e4defaf53a3603de4d306","observedAt":"2026-11-11T05:27:39.356+00:00","statement":{"source":"euvd","id":"EUVD-2026-87673","aliases":["CVE-2026-100700","GHSA-c7vw-frhj-6h9j"],"title":"nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking behavior. Attackers can supply crafted email header values with long whitespace-f…","description":"nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking behavior. Attackers can supply crafted email header values with long whitespace-free runs to block the Node.js event loop for tens of seconds, causing service unavailability.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":8.7,"severity":null}],"references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-v53p-9fqp-m79j","https://www.vulncheck.com/advisories/nodemailer-before-10.0.6-denial-of-service-via-addressparser"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-87673","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 26, 2026, 1:23:56 PM","dateUpdated":"Sep 28, 2026, 3:01:54 PM"},"relatedAdvisories":[{"id":"WID-SEC-W-2026-4410","title":"IBM App Connect Enterprise: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2026-100699","CVE-2026-100700","CVE-2026-100701","CVE-2026-100702","CVE-2026-101898","CVE-2026-101900","CVE-2026-101901","CVE-2026-101902","CVE-2026-101903","CVE-2026-101904","CVE-2026-101905","CVE-2026-101906","CVE-2026-101907","CVE-2026-101908","CVE-2026-101909","CVE-2026-101915","CVE-2026-101916","CVE-2026-104850","CVE-2026-106444","CVE-2026-106445","CVE-2026-106446","CVE-2026-110869","CVE-2026-111767","CVE-2026-15187","CVE-2026-33937","CVE-2026-83745","CVE-2026-84003","CVE-2026-86535","CVE-2026-90776","CVE-2026-91863","CVE-2026-91864","CVE-2026-91865","CVE-2026-91866","CVE-2026-91867","CVE-2026-93687","CVE-2026-93749","CVE-2026-94645","CVE-2026-94646","CVE-2026-96294"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-87673","identifiers":["EUVD-2026-87673","CVE-2026-100700","GHSA-c7vw-frhj-6h9j"]},"retained":false,"historicalAffected":[]},{"revision":"43894023b076402ba6e4a55729a0d6fd","observedAt":"2026-10-25T04:17:26.915+00:00","statement":{"source":"nvd","id":"CVE-2026-100700","aliases":[],"title":"nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking behavior. Attackers can supply crafted email header values with long whitespace-f…","description":"nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking behavior. Attackers can supply crafted email header values with long whitespace-free runs to block the Node.js event loop for tens of seconds, causing service unavailability.","state":0,"publishedAt":"2026-09-26T14:16:55.007+00:00","modifiedAt":"2026-09-30T16:32:17.94+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · disclosure@vulncheck.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":8.7,"severity":"HIGH"},{"system":"CVSS 3.1 · disclosure@vulncheck.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-v53p-9fqp-m79j","https://www.vulncheck.com/advisories/nodemailer-before-10.0.6-denial-of-service-via-addressparser"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100700","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Awaiting Analysis","weaknesses":["CWE-407"],"productCriteria":[],"sourceDates":{"published":"2026-09-26T14:16:55.007","lastModified":"2026-09-30T16:32:17.940"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-100700","identifiers":["CVE-2026-100700"]},"retained":false,"historicalAffected":[]},{"revision":"330470fb70404dd6869152f0e6755148","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-v53p-9fqp-m79j","aliases":["CVE-2026-100700"],"title":"Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service","description":"### Summary\n\nWhen `addressparser` finds no address by its strict reading, it falls back to pulling one out of the free text with `/\\s*\\b[^@\\s]+@[^\\s]+\\b\\s*/`. That pattern backtracks quadratically: `[^@\\s]+` is retried from every offset and rescans the run to the next `@` each time. A single header value holding a long whitespace-free run with no usable `@` blocks the Node.js event loop for tens of seconds.\n\nIt is cheaper to exploit than GHSA-prgh-xp8r-p3m5: 273KB is enough for ~43s, where the comment-joined shape needed ~1.5MB for ~10s.\n\n### Details\n\nThe fallback in `src/addressparser/index.ts` ran the pattern as a search. `[^@\\s]+` crosses neither whitespace nor `@`, so from each start offset it scans forward to the next `@` or to the end of the run and then fails, and the engine simply advances one character and repeats. Three shapes make every offset fail:\n\n- the run holds no `@` at all\n- the only `@` has nothing after it\n- the only `@` has nothing before it\n\nA fourth reaches it with a valid address present but placed past a long run, so the long run is walked before the match is found.\n\n### PoC\n\n```js\nconst addressparser = require('nodemailer/lib/addressparser');\nconst s = Date.now();\naddressparser(' >' + '>[x][x]'.repeat(40000)); // 273KB\nconsole.log(Date.now() - s, 'ms'); // ~43000 ms, blocking\n```\n\nMeasured on 10.0.5:\n\n| Value | Parse time |\n| --- | --- |\n| `'[x]'.repeat(40000)` (117KB) | 9.0 s |\n| `'[x]'.repeat(40000) + '@'` (117KB) | 8.9 s |\n| `'@' + '[x]'.repeat(40000)` (117KB) | 8.8 s |\n| `' >' + '>[x][x]'.repeat(40000)` (273KB) | 42.9 s |\n\n### Impact\n\nAlgorithmic-complexity denial of service. Node is single threaded, so the block stalls the whole process. Reachable without authentication anywhere inbound header values are handed to this parser, mailparser being the notable case, and reachable from application input wherever a user-supplied string is used as a message address, since `mime-node` parses `to`, `from` and `cc` when composing.\n\n### Patch\n\nThe search is replaced by a single linear pass that finds the one offset the pattern can match at, which is then applied there with a sticky regex. Match results are unchanged, verified against the previous implementation over 3.4 million random strings comparing both the match offset and the matched text, plus 800k full-parse comparisons.\n\nFound while validating the report in GHSA-prgh-xp8r-p3m5, not reported externally.","state":0,"publishedAt":"2026-09-29T23:43:36+00:00","modifiedAt":"2026-09-30T00:00:03.8382655+00:00","affected":[{"ecosystem":"npm","name":"nodemailer","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"10.0.6"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-v53p-9fqp-m79j","https://github.com/nodemailer/nodemailer/commit/437d7fc47403df176bc39271641541b7a9bce102","https://github.com/nodemailer/nodemailer","https://github.com/nodemailer/nodemailer/releases/tag/v10.0.6"],"sourceUrl":"https://github.com/advisories/GHSA-v53p-9fqp-m79j","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-v53p-9fqp-m79j","identifiers":["GHSA-v53p-9fqp-m79j","CVE-2026-100700"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-12T03:56:46.1287087+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-12T03:56:46.1287087+00:00","lastSuccessAt":"2026-11-12T03:56:46.266109+00:00","error":null,"lastVerifiedAt":"2026-11-12T03:56:46.2661097+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-64752486c567b55b31fb0d7225f5222bcd0019564ac0ac5f0649e242c7b19299-beddb039e9e8d22605e2eaa29616069a8dbcaa39d8913522266b856ccc773385","complete":true,"records":424562,"lastAttemptAt":"2026-11-12T03:56:45.0720206+00:00","lastSuccessAt":"2026-11-12T03:56:45.0520395+00:00","error":null,"lastVerifiedAt":"2026-11-12T03:56:45.0720206+00:00","snapshotPublishedAt":"2026-11-12T03:29:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-1c868b1501bb4e558d21840963f2a418","complete":false,"records":13760,"lastAttemptAt":"2026-11-12T04:04:34.4342624+00:00","lastSuccessAt":"2026-11-12T04:04:34.4923012+00:00","error":null,"lastVerifiedAt":"2026-11-12T04:04:34.4923012+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-12T03:56:46.1287087+00:00","complete":true,"records":1097,"lastAttemptAt":"2026-11-12T03:56:46.1287087+00:00","lastSuccessAt":"2026-11-12T03:56:46.2668013+00:00","error":null,"lastVerifiedAt":"2026-11-12T03:56:46.2668014+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-52451a58cbcb4287967102045f86ce70","complete":true,"records":13760,"lastAttemptAt":"2026-11-12T03:56:47.5828253+00:00","lastSuccessAt":"2026-11-12T03:56:47.579+00:00","error":null,"lastVerifiedAt":"2026-11-12T03:56:47.579+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13813,"expectedIdentifiers":13813,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-3562b6c78fd1bd0f0b55daf66a0926ae24f65e462df7f6d928caad458fc696bf","complete":true,"records":9947,"lastAttemptAt":"2026-11-12T03:56:45.7079161+00:00","lastSuccessAt":"2026-11-11T04:27:43.6877707+00:00","error":null,"lastVerifiedAt":"2026-11-12T03:56:45.7079161+00:00","snapshotPublishedAt":"2026-11-11T03:32:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-456002455e0ab94bb92c95476d4e6d175c104cd594749982afd96c893728ecbc","complete":true,"records":2010,"lastAttemptAt":"2026-11-12T03:56:45.2248127+00:00","lastSuccessAt":"2026-11-11T02:36:58.1276999+00:00","error":null,"lastVerifiedAt":"2026-11-12T03:56:45.2248127+00:00","snapshotPublishedAt":"2026-11-11T01:17:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-baa8362b4daf9e5f39d5563775a55935e7b442c0735d33274a921579ce4a0d66","complete":true,"records":3093,"lastAttemptAt":"2026-11-12T03:56:46.0887439+00:00","lastSuccessAt":"2026-11-11T13:00:02.5446881+00:00","error":null,"lastVerifiedAt":"2026-11-12T03:56:46.0887439+00:00","snapshotPublishedAt":"2026-11-11T12:47:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-685fe7fb2b690656c910a1ea42a9d294e8353311ac8ecfa691a9b0ff1b328804","complete":true,"records":231695,"lastAttemptAt":"2026-11-12T03:56:45.6007038+00:00","lastSuccessAt":"2026-11-11T21:58:47.7265713+00:00","error":null,"lastVerifiedAt":"2026-11-12T03:56:45.6007038+00:00","snapshotPublishedAt":"2026-11-11T21:48:35+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}