npm/nodemailer CVE-2026-100700: high 7.5, EPSS 0.28%
Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service
Action: Upgrade nodemailer to 10.0.6 or later.
npm i nodemailer@10.0.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 10.0.6 | - |
Fixed versions
| 10.0.6 |
Sources
- osv: GHSA-v53p-9fqp-m79j
- https://github.com/nodemailer/nodemailer/security/advisories/GHSA-v53p-9fqp-m79j
- https://github.com/nodemailer/nodemailer/commit/437d7fc47403df176bc39271641541b7a9bce102
- https://github.com/nodemailer/nodemailer
- https://github.com/nodemailer/nodemailer/releases/tag/v10.0.6
CVE-2026-100700 · published · modified · JSON