GHSA-vm5r-23w9-m8hx

Duplicate Advisory: Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser)

Published

2026-09-13

Modified

2026-10-05

Sources

github-advisory

Summary

## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-prgh-xp8r-p3m5. This link is maintained to preserve external references. ## Original Description Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms to consume excessive CPU and block the Node.js event loop for several seconds, causing denial of service.

Affected packages

Remediation: No patched version is listed by GitHub.

References

• https://github.com/advisories/GHSA-vm5r-23w9-m8hx