Nodemailer before 9.1.0 Denial of Service via addressparser

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-92596 · CVE overview and exploitation status

EUVD-2026-81296

GHSA-v554-hhrr-96v5

GHSA-2x7j-588g-ccc2

cve-program · CVE-2026-92596

• https://github.com/nodemailer/nodemailer/security/advisories/GHSA-2x7j-588g-ccc2
• https://github.com/nodemailer/nodemailer/commit/9116da9
• https://github.com/nodemailer/nodemailer/commit/7cc38af
• https://github.com/nodemailer/nodemailer/commit/34da642
• https://github.com/nodemailer/nodemailer/commit/83b8c48
• https://www.vulncheck.com/advisories/nodemailer-before-9.1.0-denial-of-service-via-addressparser

euvd · EUVD-2026-81296

• https://github.com/nodemailer/nodemailer/security/advisories/GHSA-2x7j-588g-ccc2
• https://github.com/nodemailer/nodemailer/commit/9116da9
• https://github.com/nodemailer/nodemailer/commit/7cc38af
• https://github.com/nodemailer/nodemailer/commit/34da642
• https://github.com/nodemailer/nodemailer/commit/83b8c48
• https://www.vulncheck.com/advisories/nodemailer-before-9.1.0-denial-of-service-via-addressparser

nvd · CVE-2026-92596

• https://github.com/nodemailer/nodemailer/commit/34da642
• https://github.com/nodemailer/nodemailer/commit/7cc38af
• https://github.com/nodemailer/nodemailer/commit/83b8c48
• https://github.com/nodemailer/nodemailer/commit/9116da9
• https://github.com/nodemailer/nodemailer/security/advisories/GHSA-2x7j-588g-ccc2
• https://www.vulncheck.com/advisories/nodemailer-before-9.1.0-denial-of-service-via-addressparser

osv · GHSA-2x7j-588g-ccc2

• https://github.com/nodemailer/nodemailer/security/advisories/GHSA-2x7j-588g-ccc2
• https://github.com/nodemailer/nodemailer/pull/1848
• https://github.com/nodemailer/nodemailer/commit/34da64282dcdc9b0581c721a27ab2fa226673150
• https://github.com/nodemailer/nodemailer/commit/7cc38af418ffa6fc7e86085195ca5ca681694b3e
• https://github.com/nodemailer/nodemailer/commit/9116da9528c6524cefaed75185602a7e85d20434
• https://github.com/nodemailer/nodemailer
• https://github.com/nodemailer/nodemailer/releases/tag/v9.1.0

• Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows remote attackers to cause denial of service by supplying a crafted comma-separated address list. Attackers can send a sing… · Advisory content revised · 11 Nov 2026