High severity7.5NVD Advisory· Published Sep 26, 2026· Updated Sep 30, 2026
CVE-2026-100700
CVE-2026-100700
Description
nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking behavior. Attackers can supply crafted email header values with long whitespace-free runs to block the Node.js event loop for tens of seconds, causing service unavailability.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <10.0.6
Patches
Vulnerability mechanics
References
2News mentions
1- Nodemailer: Four Vulnerabilities Including DoS and Stack Exhaustion Disclosed TogetherVypr Intelligence · Sep 26, 2026