@1amsheldon/mail-mcp (>=1.5.0, <=2.0.1), @27works/posto (>=1.0.0, <=2.0.2) +847 more potentially affected by CVE-2026-90776 via nodemailer (>=9.1.0, <=10.0.3)

nodemailer NPM version =9.1.0, =1.5.0, =1.0.0, =1.6.3, =0.3.64, =0.1.0, =1.0.2, =0.1.0, =2.0.2, =2.0.0, =0.2.2-rc.0, =1.0.5, =2.0.1, =2.0.3 and more Source cves: CVE-2026-90776 Source advisory: OSV:GHSA-PRGH-XP8R-P3M5...

CVE-2026-90776

creationtimestamp| type| source ---|---|--- 2026-09-13 13:00:43+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvfnnujqog2o 2026-09-13 16:50:43+00:00| seen| https://gist.github.com/ichintu/ccd66f14a97ed0726d9247eeed3e2e87 2026-09-16 07:27:26+00:00| seen|...

UBUNTU-CVE-2026-90776

Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms to consume excessive CPU and block the Node.js...

@1amsheldon/mail-mcp (>=1.5.0, <=2.0.1), @27works/posto (>=1.0.0, <=2.0.2) +847 more potentially affected by CVE-2026-90776 via nodemailer (>=9.1.0, <=10.0.3)

nodemailer NPM version =9.1.0, =1.5.0, =1.0.0, =1.6.3, =0.3.64, =0.1.0, =1.0.2, =0.1.0, =2.0.2, =2.0.0, =0.2.2-rc.0, =1.0.5, =2.0.1, =2.0.3 and more Source cves: CVE-2026-90776 Source advisory: MEND:CVE-2026-90776...