{"id":"EUVD-2026-81296","enisaUuid":"00cbbcdf-118e-32fb-9c4a-00769a5f6e57","description":"Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows remote attackers to cause denial of service by supplying a crafted comma-separated address list. Attackers can send a single email with a large number of addresses to block the Node.js event loop for extended periods, consuming 100% CPU and freezing the process.","datePublished":"Sep 16, 2026, 9:47:00 PM","dateUpdated":"Sep 17, 2026, 1:23:33 PM","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-2x7j-588g-ccc2\nhttps://github.com/nodemailer/nodemailer/commit/9116da9\nhttps://github.com/nodemailer/nodemailer/commit/7cc38af\nhttps://github.com/nodemailer/nodemailer/commit/34da642\nhttps://github.com/nodemailer/nodemailer/commit/83b8c48\nhttps://www.vulncheck.com/advisories/nodemailer-before-9.1.0-denial-of-service-via-addressparser\n","aliases":"CVE-2026-92596\nGHSA-v554-hhrr-96v5\n","assigner":"VulnCheck","epss":0.82,"enisaIdProduct":[{"id":"25854829-3962-3526-ad98-ff08f1b8f48a","product":{"name":"nodemailer","vendor":{"name":"nodemailer"}},"product_version":"0 \u003c9.1.0"}],"enisaIdVendor":[{"id":"c74c05bc-e128-352e-b0fd-dcff08d9e906","vendor":{"name":"nodemailer"}}],"enisaIdVulnerability":[{"id":"46d5e742-45ff-3871-99b9-ecdf7b94f168","vulnerability":{"id":"GHSA-v554-hhrr-96v5","description":"Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows remote attackers to cause denial of service by supplying a crafted comma-separated address list. Attackers can send a single email with a large number of addresses to block the Node.js event loop for extended periods, consuming 100% CPU and freezing the process.","datePublished":"Sep 17, 2026, 12:31:27 AM","dateUpdated":"Sep 17, 2026, 12:31:27 AM","baseScore":0.0,"references":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-2x7j-588g-ccc2\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-92596\nhttps://github.com/nodemailer/nodemailer/commit/34da642\nhttps://github.com/nodemailer/nodemailer/commit/7cc38af\nhttps://github.com/nodemailer/nodemailer/commit/83b8c48\nhttps://github.com/nodemailer/nodemailer/commit/9116da9\nhttps://www.vulncheck.com/advisories/nodemailer-before-9.1.0-denial-of-service-via-addressparser\n","enisa_id":"EUVD-2026-81296\n","aliases":"CVE-2026-92596\nGHSA-v554-hhrr-96v5\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:53:48 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"5e381ba5-68a5-33e1-987d-4a9fac1b8aa6","vulnerability":{"id":"CVE-2026-92596","description":"Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows remote attackers to cause denial of service by supplying a crafted comma-separated address list. Attackers can send a single email with a large number of addresses to block the Node.js event loop for extended periods, consuming 100% CPU and freezing the process.","datePublished":"Sep 16, 2026, 9:47:00 PM","dateUpdated":"Sep 17, 2026, 1:23:33 PM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-2x7j-588g-ccc2\nhttps://github.com/nodemailer/nodemailer/commit/9116da9\nhttps://github.com/nodemailer/nodemailer/commit/7cc38af\nhttps://github.com/nodemailer/nodemailer/commit/34da642\nhttps://github.com/nodemailer/nodemailer/commit/83b8c48\nhttps://www.vulncheck.com/advisories/nodemailer-before-9.1.0-denial-of-service-via-addressparser\n","enisa_id":"EUVD-2026-81296\n","assigner":"VulnCheck","epss":0.82,"dataProcessed":"Nov 11, 2026, 7:22:38 AM","vulnerabilityProduct":[{"id":"06a22d57-8a07-35a5-a390-46aee7ce2a2d","product":{"name":"nodemailer","vendor":{"name":"nodemailer"}},"product_version":"0 \u003c9.1.0"}],"vulnerabilityVendor":[{"id":"8b3a7044-623e-3639-a991-faf6f19e4131","vendor":{"name":"nodemailer"}}]}}],"enisaIdAdvisory":[{"id":"60b11a89-18bd-3fa1-a013-5a53ee8c393c","advisory":{"id":"WID-SEC-W-2026-3621","description":"IBM App Connect Enterprise: Mehrere Schwachstellen","summary":"Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Informationen offenzulegen, um einen Denial of Service Angriff durchzuführen, um Daten zu manipulieren und um Sicherheitsvorkehrungen zu umgehen.","datePublished":"Sep 28, 2026, 10:00:00 PM","dateUpdated":"Nov 9, 2026, 11:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3621.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2026-3621\n","aliases":"CVE-2022-35948\nCVE-2026-13697\nCVE-2026-14643\nCVE-2026-15157\nCVE-2026-1527\nCVE-2026-16728\nCVE-2026-16729\nCVE-2026-59871\nCVE-2026-59873\nCVE-2026-59874\nCVE-2026-59875\nCVE-2026-92595\nCVE-2026-92596\nCVE-2026-92597\nCVE-2026-92598\nCVE-2026-9678\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"298227bf-9e0b-324a-b12d-3645db881772","product":{"name":"Certified Container Operator 13.7.0","vendor":{"name":"IBM"}}},{"id":"a3910b2c-209e-3ced-8be5-e1fd94ba32d4","product":{"name":"App Connect Enterprise","vendor":{"name":"IBM"}}},{"id":"d9285d09-f075-3fbe-838e-d38ea4f0512c","product":{"name":"Certified Container Operator 12.0.29","vendor":{"name":"IBM"}}},{"id":"de25174d-290f-3b64-8193-e4b54d26c45d","product":{"name":"13.0.9.0","vendor":{"name":"IBM"}}}]}}]}