GHSA-2x7j-588g-ccc2: Algorithmic Complexity Denial of Service in Nodemailer
Vulnerability ID: GHSA-2X7J-588G-CCC2
CVSS Score: 7.5
Published: 2026-09-08
An algorithmic complexity vulnerability in Nodemailer before version 9.1.0 allows remote attackers to block the Node.js event loop. This denial of service is triggered by processing large or complex lists of email addresses, leading to quadratic resource consumption.
TL;DR
Nodemailer versions prior to 9.1.0 are vulnerable to remote Denial of Service (DoS) due to quadratic time complexity ($O(n^2)$) in the address parser and envelope generation modules, which blocks the single-threaded Node.js event loop.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-400
- Attack Vector: Network (Unauthenticated)
- CVSS Score: 7.5
- EPSS Score: 0.00045
- Impact: Denial of Service (DoS)
- Exploit Status: poc
- KEV Status: Not Listed
Affected Systems
- Applications utilizing Nodemailer versions prior to 9.1.0 that parse untrusted recipient or header arrays.
-
nodemailer: < 9.1.0 (Fixed in:
9.1.0)
Code Analysis
Commit: 9116da9
Refactor address parser to operate in linear time complexity
Commit: 7cc38af
Optimize mime-node address deduplication via Set
Commit: 34da642
Ensure cross-header deduplication scales linearly
Exploit Details
- GitHub Advisory: Official GitHub Security Advisory describing the quadratic scaling behavior during address parsing.
Mitigation Strategies
- Upgrade Nodemailer to version 9.1.0 or higher to apply the linear-time complexity patches.
- Implement input length validation limits on all email input fields at the application edge.
- Reject email inputs containing an excessive number of comma separators before parsing them in Nodemailer.
Remediation Steps:
- Locate your project's package.json file.
- Update the 'nodemailer' dependency definition to '^9.1.0'.
- Run the command 'npm update nodemailer' or 'yarn upgrade nodemailer' to pull the patched version.
- Deploy the updated dependency to production environments and monitor CPU utilization.
References
Read the full report for GHSA-2X7J-588G-CCC2 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)