{"uuid": "91418152-0d54-494a-9a05-46b3310d0d70", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-2x7j-588g-ccc2", "type": "seen", "source": "https://gist.github.com/alon710/bd83a6e5a1c5d7e3eb1a208578e25c78", "content": "# GHSA-2X7J-588G-CCC2: GHSA-2x7j-588g-ccc2: Algorithmic Complexity Denial of Service in Nodemailer\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-08\n> **Full Report:** https://cvereports.com/reports/GHSA-2X7J-588G-CCC2\n\n## Summary\nAn algorithmic complexity vulnerability in Nodemailer before version 9.1.0 allows remote attackers to block the Node.js event loop. This denial of service is triggered by processing large or complex lists of email addresses, leading to quadratic resource consumption.\n\n## TL;DR\nNodemailer versions prior to 9.1.0 are vulnerable to remote Denial of Service (DoS) due to quadratic time complexity ($O(n^2)$) in the address parser and envelope generation modules, which blocks the single-threaded Node.js event loop.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network (Unauthenticated)\n- **CVSS Score**: 7.5\n- **EPSS Score**: 0.00045\n- **Impact**: Denial of Service (DoS)\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications utilizing Nodemailer versions prior to 9.1.0 that parse untrusted recipient or header arrays.\n- **nodemailer**: < 9.1.0 (Fixed in: `9.1.0`)\n\n## Mitigation\n\n- Upgrade Nodemailer to version 9.1.0 or higher to apply the linear-time complexity patches.\n- Implement input length validation limits on all email input fields at the application edge.\n- Reject email inputs containing an excessive number of comma separators before parsing them in Nodemailer.\n\n**Remediation Steps:**\n1. Locate your project's package.json file.\n2. Update the 'nodemailer' dependency definition to '^9.1.0'.\n3. Run the command 'npm update nodemailer' or 'yarn upgrade nodemailer' to pull the patched version.\n4. Deploy the updated dependency to production environments and monitor CPU utilization.\n\n## References\n\n- [GHSA-2x7j-588g-ccc2 Advisory](https://github.com/advisories/GHSA-2X7J-588G-CCC2)\n- [Nodemailer Release v9.1.0](https://github.com/nodemailer/nodemailer/releases/tag/v9.1.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-2X7J-588G-CCC2) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-09T00:32:15.663001Z"}