high7.5
CVE-2026-100700
nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking …
Impact
nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking behavior. Attackers can supply crafted email header values with long whitespace-free runs to block the Node.js event loop for tens of seconds, causing service unavailability.
Affected products
| Product | Affected versions |
|---|---|
| Nodemailer | before 10.0.6 |
Versions were read from the advisory text. No structured product data has been published for this record yet.