AIKIDO-2026-612508
nodemailer is vulnerable to Regular Expression Denial of Service (ReDoS)
75
High Risk
This Affects:
nodemailerTL;DR
The addressparser free-text fallback searches for an embedded address with the regex /\s*\b[^@\s]+@[^\s]+\b\s*/, whose [^@\s]+ component is retried from every offset and rescans each run to the next @. On a long header run that holds no usable @, this search runs in quadratic time and blocks the Node.js event loop. A crafted value of a few hundred kilobytes stalls processing for tens of seconds, and inbound message headers reach the parser through mailparser without a length limit. The fix locates the single candidate offset with a linear scan and applies the regex only once at that position.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you pass untrusted or user-supplied email address strings or headers to the address parser, for example inbound messages parsed via mailparser.
Background info
nodemailer is vulnerable to Regular Expression Denial of Service (ReDoS) in versions 3.0.0 - 10.0.5.
How to fix this
Upgrade the nodemailer library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.