CVE-2026-110872

Vulnerability summary

addressparser ends an RFC 5322 group at the first ;, including one inside a quoted display name or a comment. The text after it is parsed again as top level recipients with the quoting flipped, so text that every conformant parser reads as a display name or comment becomes a live address. G: (a; <[email protected]>) <[email protected]>; names only [email protected], and Nodemailer read it as the single recipient [email protected]. Affected: 3.0.0 through 10.1.3.

Attacker capabilities

The attacker controls the text of an address field that an application passes to Nodemailer, or the header of an inbound message parsed with mailparser. No access to the application, its configuration or its credentials is needed. The value is a syntactically valid RFC 5322 group that conformant parsers accept without defects.

Realistic exploitation scenario

An application validates the recipients of a submitted address list with a conformant parser and only allows addresses at its own domain. The attacker submits G: (a; <[email protected]>) <[email protected]>;. The validator sees one mailbox, [email protected], and approves it. Nodemailer delivers to [email protected] only. The same works through a quoted display name, G: "a;" "<[email protected]>" <[email protected]>;. The boundary crossed is the application's recipient allow list.

Proof of concept

const addressparser = require('nodemailer/lib/addressparser');
console.log(addressparser("G: (a; <[email protected]>) <[email protected]>;"));
// [ { name: 'G', group: [ [Object] ] }, { address: '[email protected]', name: ') [email protected]' } ]

Python's email._header_value_parser.get_address_list reads the same value as the single mailbox [email protected], with no defects reported.

The envelope a message gets is built from the same parse, so sendMail({ to: "G: (a; <[email protected]>) <[email protected]>;" }) issues the RCPT TO shown above.

Security impact

Mail that an application intends for an approved recipient goes to a recipient chosen by the attacker, which discloses its content, and the intended recipient never receives it. The misreading only occurs on values a conformant validator approves, so correct validation is bypassed, which makes it a security issue rather than a parsing bug. Affected are applications that pass user influenced address lists to Nodemailer and consumers of the standalone parser such as mailparser.

The fix tracks quoted strings and comments inside a group and reads only a ; outside them.

Found in an internal review of addressparser on 2026-10-18. Verified on 3.0.0, 6.9.16 and 10.1.3.

Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection._onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before authentication, blocking the Node.js event loop and exhausting memory.

Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection._onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before authentication, blocking the Node.js event loop and exhausting memory.

Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection._onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before authentication, blocking the Node.js event loop and exhausting memory.

Summary

The SMTP client response parser reassembles multiline server replies by appending each continuation line onto a single response-queue entry and re-testing whether that entry is still a partial (continuation) reply on every line. The partial-response test runs str.slice(str.lastIndexOf('\n') + 1) on the growing entry, which forces a full flatten of the entire accumulated string on each line. A malicious or compromised SMTP server (or an on-path attacker on a plaintext or pre-STARTTLS hop) that streams continuation lines and never sends a completion line drives O(n^2) CPU on the single-threaded Node.js event loop before any authentication, freezing the whole process for an attacker-controlled duration.

Root Cause

The invariant that a server cannot cause superlinear client-side work while a reply is being reassembled is violated. In src/smtp-connection/index.ts, _onData splits inbound bytes into lines and, while the last queued entry is a continuation reply, concatenates each new line onto that same entry with this._responseQueue[len - 1] += '\n' + lines[i]. On every iteration it calls isPartialResponse(lastline), which evaluates /^\d+-/.test(str.slice(str.lastIndexOf('\n') + 1)). Because the queued entry grows by one line per continuation line and is stored as a V8 rope (ConsString), each lastIndexOf/slice forces a full string flatten of length proportional to the accumulated reply. Executed once per line over n continuation lines, this is O(n^2) CPU. While the reply stays partial the function early-returns and never resets the entry, so the growth and the per-line reflatten continue unbounded. There is no response-size or line-count cap in the connection code; the only limits are time-based (greetingTimeout, and an inactivity socketTimeout), and neither bounds accumulated reply size.

Affected file and functions (verified at the published v10.0.9 artifact, in src/ and in the built dist/cjs and dist/esm output):
- src/smtp-connection/index.ts: isPartialResponse (the /^\d+-/ test over str.slice(str.lastIndexOf('\n')+1))
- src/smtp-connection/index.ts: SMTPConnection._onData (the continuation-line append loop with no size cap)

Impact

An attacker who is, or can impersonate, the SMTP peer the client connects to can freeze the connecting Node.js process. Because Node.js is single-threaded, event-loop starvation halts all other work in that process (every other connection, request, and timer), not just the offending SMTP session. The reply is parsed during the greeting and EHLO phases, before the client authenticates or issues any command, so no credentials on the client are required. The blocking duration scales with the volume of continuation data the attacker streams and can be sustained indefinitely by continuing to stream, and memory for the accumulated entry also grows without bound. Independent reproduction on Node.js 24 measured roughly 11.6 seconds of event-loop blocking for about 640 KB of continuation data and roughly 47 seconds for about 1.3 MB, scaling quadratically. This is a repeatable remote denial of service against the sending process.

Proof of Concept

Node.js 24; a raw TCP listener acting as a hostile SMTP server; the client uses the shipped SMTPConnection (require('nodemailer/lib/smtp-connection')).

Steps: (1) start a TCP server that accepts a connection and streams continuation lines of the form 220-flood...\r\n in large batches, never emitting a completion line such as 220 ready; (2) point an SMTPConnection at it and observe the client event loop stall while the single response-queue entry grows and is reflattened on every line. A minimal microbenchmark of the exact parsing logic demonstrates the complexity:

// Reproduces isPartialResponse + the _onData append loop verbatim (Node 24).
function isPartialResponse(str) { return /^\d+-/.test(str.slice(str.lastIndexOf('\n') + 1)); }
function run(n) {
    const queue = [];
    let remainder = '';…

Vulnerability summary

addressparser ends an angle-addr at the first > it sees, including one inside a quoted local part, a comment or a domain literal. The domain is then read off the text in front of that >. <"[email protected]>"@good.com> is the mailbox "[email protected]>"@good.com under RFC 5322, and Nodemailer read it as an address at evil.com. The unbracketed spelling of the same value was already read correctly. Affected: 3.0.0 through 10.1.3.

Attacker capabilities

The attacker controls the text of a recipient or sender address that an application passes to Nodemailer, for example a To value entered in a contact or invite form, or the header of an inbound message parsed with mailparser. No access to the application, its configuration or its credentials is needed. The value is a syntactically valid RFC 5322 address that conformant parsers accept without defects.

Realistic exploitation scenario

An application lets users send invitations or notifications only to addresses at an allowed domain and validates the submitted value with a conformant parser or by checking its domain. The attacker submits <"[email protected]>"@good.com>, which validates as a good.com mailbox. Nodemailer then parses the same value, issues RCPT TO:<"\"a"@evil.com> and the message, with whatever content the application puts into it, is delivered to the attacker's domain. The security boundary crossed is the application's recipient allow list. In the inbound direction, mailparser reports a different address than a conformant reader of the same header, so a display or policy layer built on the two disagrees.

Proof of concept

const addressparser = require('nodemailer/lib/addressparser');
console.log(addressparser("<\"[email protected]>\"@good.com>"));
// [ { address: '"[email protected]', name: '@good.com>' } ]

Python's email._header_value_parser.get_address_list reads the same value as "[email protected]>"@good.com, with no defects reported.

The envelope a message gets is built from the same parse, so sendMail({ to: "<\"[email protected]>\"@good.com>" }) issues the RCPT TO shown above.

Security impact

Mail that an application intends for an allowed domain is delivered to a domain chosen by the attacker, which discloses its content. It is a security vulnerability rather than a parsing bug because the misreading only occurs for values that a conformant validator approves, so validation done the right way is bypassed. Affected are applications that pass user influenced addresses to Nodemailer and consumers of the standalone parser such as mailparser.

The fix tracks quoted strings, comments and domain literals inside an angle-addr and reads only a > outside them.

Found in an internal review of addressparser on 2026-10-18. Verified on 3.0.0, 6.9.16 and 10.1.3.

Vulnerability summary

RFC 5322 comments nest. addressparser ended a comment at the first ), including the one that closes a nested comment, and parsed the rest of the outer comment as header text. Victim (x(y) <[email protected]>) <[email protected]> names [email protected] with x(y) <[email protected]> as a comment, and Nodemailer read it as the address [email protected]. This is the same shape as the escaped parenthesis fixed in 10.1.2, reached through nesting instead of a quoted-pair. Affected: 3.0.0 through 10.1.3.

Attacker capabilities

The attacker controls the text of an address that an application passes to Nodemailer, or the From or To header of an inbound message parsed with mailparser. No access to the application, its configuration or its credentials is needed. The value is a syntactically valid RFC 5322 address that conformant parsers accept without defects.

Realistic exploitation scenario

An application validates a submitted address with a conformant parser and allows only its own domain. The attacker submits Victim (x(y) <[email protected]>) <[email protected]>, which validates as [email protected]. Nodemailer delivers to [email protected]. In the inbound direction, a DMARC or display layer built on a conformant parser and a mail client built on mailparser disagree on the author of the same message, which is the setting for sender spoofing. The boundary crossed is the application's recipient allow list, or the author check of the receiving side.

Proof of concept

const addressparser = require('nodemailer/lib/addressparser');
console.log(addressparser("Victim (x(y) <[email protected]>) <[email protected]>"));
// [ { address: '[email protected]', name: 'Victim) [email protected]' } ]

Python's email._header_value_parser.get_address_list reads the same value as [email protected] with the display name Victim, with no defects reported.

The envelope a message gets is built from the same parse, so sendMail({ to: "Victim (x(y) <[email protected]>) <[email protected]>" }) issues the RCPT TO shown above.

Security impact

Mail intended for an approved recipient is delivered to an attacker chosen domain, disclosing its content, and parsers built on this module report a different author than conformant ones. The misreading only occurs on values a conformant validator approves, so correct validation is bypassed. Affected are applications that pass user influenced addresses to Nodemailer and consumers of the standalone parser such as mailparser.

The fix counts comment depth and ends a comment only at the ) that closes the outermost one.

Found in an internal review of addressparser on 2026-10-18. Verified on 3.0.0, 6.9.16 and 10.1.3.

Vulnerability summary

addressparser ends an RFC 5322 group at the first ;, including one inside a quoted display name or a comment. The text after it is parsed again as top level recipients with the quoting flipped, so text that every conformant parser reads as a display name or comment becomes a live address. G: (a; <[email protected]>) <[email protected]>; names only [email protected], and Nodemailer read it as the single recipient [email protected]. Affected: 3.0.0 through 10.1.3.

Attacker capabilities

The attacker controls the text of an address field that an application passes to Nodemailer, or the header of an inbound message parsed with mailparser. No access to the application, its configuration or its credentials is needed. The value is a syntactically valid RFC 5322 group that conformant parsers accept without defects.

Realistic exploitation scenario

An application validates the recipients of a submitted address list with a conformant parser and only allows addresses at its own domain. The attacker submits G: (a; <[email protected]>) <[email protected]>;. The validator sees one mailbox, [email protected], and approves it. Nodemailer delivers to [email protected] only. The same works through a quoted display name, G: "a;" "<[email protected]>" <[email protected]>;. The boundary crossed is the application's recipient allow list.

Proof of concept

const addressparser = require('nodemailer/lib/addressparser');
console.log(addressparser("G: (a; <[email protected]>) <[email protected]>;"));
// [ { name: 'G', group: [ [Object] ] }, { address: '[email protected]', name: ') [email protected]' } ]

Python's email._header_value_parser.get_address_list reads the same value as the single mailbox [email protected], with no defects reported.

The envelope a message gets is built from the same parse, so sendMail({ to: "G: (a; <[email protected]>) <[email protected]>;" }) issues the RCPT TO shown above.

Security impact

Mail that an application intends for an approved recipient goes to a recipient chosen by the attacker, which discloses its content, and the intended recipient never receives it. The misreading only occurs on values a conformant validator approves, so correct validation is bypassed, which makes it a security issue rather than a parsing bug. Affected are applications that pass user influenced address lists to Nodemailer and consumers of the standalone parser such as mailparser.

The fix tracks quoted strings and comments inside a group and reads only a ; outside them.

Found in an internal review of addressparser on 2026-10-18. Verified on 3.0.0, 6.9.16 and 10.1.3.

Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection._onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before authentication, blocking the Node.js event loop and exhausting memory.

TuxCare rebuilt nodemailer to address 2 CVEs. Fixed in 9.0.6-tuxcare.3.

TuxCare rebuilt nodemailer to address 3 CVEs. Fixed in 9.1.0-tuxcare.6.

TuxCare rebuilt nodemailer to address 2 CVEs. Fixed in 9.0.5-tuxcare.4.

TuxCare rebuilt nodemailer to address 2 CVEs. Fixed in 9.0.3-tuxcare.4.

TuxCare rebuilt nodemailer to address 2 CVEs. Fixed in 9.0.2-tuxcare.4.

TuxCare rebuilt nodemailer to address 2 CVEs. Fixed in 9.0.2-tuxcare.6.

TuxCare rebuilt nodemailer to address 1 CVE. Fixed in 9.0.6-tuxcare.5.

TuxCare rebuilt nodemailer to address 3 CVEs. Fixed in 9.1.0-tuxcare.7.

TuxCare rebuilt nodemailer to address 2 CVEs. Fixed in 9.0.5-tuxcare.6.

TuxCare rebuilt nodemailer to address 3 CVEs. Fixed in 9.0.0-tuxcare.6.

TuxCare rebuilt nodemailer to address 3 CVEs. Fixed in 9.0.3-tuxcare.6.

TuxCare rebuilt nodemailer to address 4 CVEs. Fixed in 9.0.1-tuxcare.5.

TuxCare rebuilt nodemailer to address 3 CVEs. Fixed in 6.10.1-tuxcare.15.

TuxCare rebuilt nodemailer to address 1 CVE. Fixed in 9.0.5-tuxcare.7.

TuxCare rebuilt nodemailer to address 1 CVE. Fixed in 9.0.2-tuxcare.7.

TuxCare rebuilt nodemailer to address 2 CVEs. Fixed in 9.0.6-tuxcare.6.

TuxCare rebuilt nodemailer to address 1 CVE. Fixed in 9.0.0-tuxcare.7.

TuxCare rebuilt nodemailer to address 1 CVE. Fixed in 6.10.1-tuxcare.16.

TuxCare rebuilt nodemailer to address 2 CVEs. Fixed in 2.7.2-tuxcare.10.