CVE-2026-92596: Nodemailer

High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days.

Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows remote attackers to cause denial of service by supplying a crafted comma-separated address list. Attackers can send a single email with a large number of addresses to block the Node.js event loop for extended periods, consuming 100% CPU and freezing the process.

Affected products

• Nodemailer Nodemailer: before 9.1.0 (fixed in 9.1.0)

Published 2026-09-16. Last modified 2026-09-22.