AIKIDO-2026-289675
nodemailer is vulnerable to Denial of Service (DoS)
75
High Risk
This Affects:
nodemailerTL;DR
Nodemailer's address parser accumulates parsed entries by rebuilding an array with concat on every address in the list. Parsing a large address string therefore scales with the square of its length, so an externally influenced recipient or header value can block the event loop for many seconds. A crafted address string around one megabyte can freeze the process long enough to deny service. The fix appends entries in place and rewrites the display-name merge so parsing runs in linear time.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application parses or sends messages with address or recipient values derived from untrusted input.
Background info
nodemailer is vulnerable to Denial of Service (DoS) in versions 8.0.2 - 9.0.6.
How to fix this
Upgrade the nodemailer library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.