NPM: Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list

NPM: Nodemailer: Quadratic On² time complexity in addressparser allows remote denial of service via a crafted address list vulnerability discovered by ? in WordPress Npm nodemailer versions 9.1.0...

Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list

Summary Nodemailer's address parser lib/addressparser/index.js parses a list of comma‑separated addresses in quadratic time — On² in the number of addresses. A single crafted address string e.g. a To, Cc, Bcc, From, or Reply‑To value, or any value passed to the exported addressparser therefore...

Inefficient Algorithmic Complexity

Overview nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the addressparser function in lib/addressparser/index.js. An attacker can block the Node.js event loop by supplying a...

Inefficient Algorithmic Complexity

Overview org.webjars.npm:nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the addressparser function in lib/addressparser/index.js. An attacker can block the Node.js event loo...

Interpretation Conflict

Overview nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Interpretation Conflict via RFC 5322 comment mis-parsing in lib/addressparser/index.js. An attacker can make mail be delivered to an attacker-controlled domain ...

Interpretation Conflict

Overview org.webjars.npm:nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Interpretation Conflict via RFC 5322 comment mis-parsing in lib/addressparser/index.js. An attacker can make mail be delivered to an...

PT-2026-94114

Name of the Vulnerable Software and Affected Versions Nodemailer versions 6.9.16 through 9.0.x Description Nodemailer mis-parses RFC 5322 comments within email addresses. In the lib/addressparser component, when a comment is closed immediately before a non-break character, the tokenizer...

PT-2026-95043

Summary Nodemailer's address parser lib/addressparser/index.js parses a list of comma‑separated addresses in quadratic time — On² in the number of addresses. A single crafted address string e.g. a To, Cc, Bcc, From, or Reply‑To value, or any value passed to the exported addressparser therefore...

PT-2026-94113

Name of the Vulnerable Software and Affected Versions Nodemailer versions prior to 9.1.0 Description Nodemailer contains a quadratic time complexity issue in its addressparser component. When parsing a list of comma-separated addresses, the parser uses Array.prototype.concat to accumulate results...

Uncontrolled Recursion

Overview org.webjars.npm:nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Uncontrolled Recursion in the addressparser function. An attacker can cause the process to terminate immediately by sending an email address...

Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls

Summary A DoS can occur that immediately halts the system due to the use of an unsafe function. Details According to RFC 5322, nested group structures a group inside another group are not allowed. Therefore, in lib/addressparser/index.js, the email address parser performs flattening when nested...

Uncontrolled Recursion

Overview nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Uncontrolled Recursion in the addressparser function. An attacker can cause the process to terminate immediately by sending an email address header containing...

Malware in @puresec/addressparser-malicious

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2022-537 Malicious code in @puresec/addressparser-malicious (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f35f0d4232324d0184d75d7cfba054b0a74327c8351544f0540d29b6a894c6a9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...