AIKIDO-2026-50889
nodemailer is vulnerable to Denial of Service (DoS)
75
High Risk
This Affects:
nodemailerTL;DR
The addressparser module joins email addresses separated by RFC 5322 comments by re-reading the last character of the growing accumulator with parts[parts.length - 1].slice(-1) on every token. That repeated slice flattens the accumulated run each time, so a single address built from many comment-joined atoms is processed in quadratic time. A crafted address string of a few hundred kilobytes blocks the Node.js event loop for several seconds, and mailparser feeds inbound message headers into the parser without a length limit. The fix carries the last character alongside the parsing state so the join condition no longer rescans the accumulator.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you pass untrusted or user-supplied email address strings or headers to the address parser, for example inbound messages parsed via mailparser.
Background info
nodemailer is vulnerable to Denial of Service (DoS) in versions 9.1.0 - 10.0.4.
How to fix this
Upgrade the nodemailer library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.