CVE-2026-90776

Executive Summary

CVE-2026-90776 is a denial-of-service vulnerability in the Nodemailer Node.js library affecting versions 9.1.0 through 10.0.4. The flaw resides in the addressparser component, which exhibits quadratic (O(n²)) time complexity when parsing email addresses containing RFC 5322 comments structured with comment-separated atoms. A remote attacker can submit a specially crafted email header that forces disproportionate CPU consumption, blocking the Node.js event loop for several seconds and degrading or halting service for all concurrent users. With a CVSS base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), exploitation requires no authentication, no user interaction, and is network-reachable, making any internet-facing mail-processing service built on Nodemailer a viable target.

Technical Analysis

Nodemailer is one of the most widely deployed email-sending libraries in the Node.js ecosystem, used both for constructing outbound messages and, in many applications, for parsing inbound message headers. The addressparser component — the module responsible for decomposing address header fields (such as From, To, Cc, and Bcc) into structured mailbox objects — is the vulnerable parsing surface in this CVE.

The core defect is algorithmic, not memory-safety related. It is classified under CWE-407 (Inefficient Algorithmic Complexity). Consistent with the NVD description, versions 9.1.0 through 10.0.4 parse email addresses in a manner that degenerates to quadratic time complexity — O(n²) — when the input contains RFC 5322 comments composed of comment-separated atoms.

RFC 5322 permits comments (parenthesized text, e.g. (...)) to appear adjacent to address atoms, and permits nesting and repetition of these constructs. A parser that re-scans or repeatedly walks the input for each comment/atom boundary will perform work proportional to the square of the number of such elements. Because email headers are attacker-controlled in any system that ingests external mail (or forwards user-supplied header content into Nodemailer's address parser), an adversary can supply a header with a large number of comment-separated atoms and drive CPU utilization up sharply with a single, small request.

Node.js executes application logic on a single-threaded event loop. A synchronous parser that spends seconds of CPU time on one header cannot yield to other tasks; during that window, all other requests handled by the same process are blocked. This is the mechanism that converts a parsing inefficiency into a service-wide denial of service.

Key facts derivable from the supplied data:

• Vulnerable component: addressparser (verbatim from NVD description).
• Vulnerable versions: 9.1.0 through 10.0.4 (verbatim).
• Attack surface: email address/header parsing involving RFC 5322 comments.
• Trigger construct: comment-separated atoms (verbatim).
• Impact mechanism: excessive CPU consumption blocking the Node.js event loop for several seconds (verbatim).
• Root cause class: inefficient algorithmic complexity (CWE-407), quadratic time complexity.

Insufficient technical detail is available to describe specific internal function names, data structures, or the exact regex/loop pattern responsible. Any such specifics would be speculation and are deliberately omitted.

Notably, no public proof-of-concept, no Nuclei template, and no exploit code are currently tracked for this CVE, and the vulnerability is not listed in CISA KEV.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (algorithmic complexity DoS) and the NVD description. Only constructs explicitly named in the description are used.

1. Reconnaissance / target identification. An attacker identifies a target service that uses Nodemailer 9.1.0–10.0.4 and that parses externally influenced email headers via addressparser. Candidate targets include mail-processing services, contact/notification form handlers, inbound mail gateways, ticketing/CRM systems that parse From/To/Cc headers, and any endpoint that passes user-supplied header values into Nodemailer's address parser. Fingerprinting would focus on Node.js/Express-based mail applications; Shodan dorks above can help locate exposed instances.

2. Triggering the flaw class. The attacker constructs an email address header field containing a large quantity of RFC 5322 comments arranged with comment-separated atoms. The goal is to maximize the number of comment/atom boundaries so that the event-loop-blocking effect of the quadratic parser is reached. This is a resource-exhaustion (T1499) pattern: a single small input yields disproportionate CPU cost.

3. Payload/execution method (vulnerability-class level). The crafted header is delivered either as part of an inbound email message or by submitting user-controlled header content into a component that feeds the address parser. No authentication or user interaction is required (PR:N/UI:N). Because the parser is synchronous, the request occupies the event loop while it processes the malformed input.

4. Post-exploitation impact. Each malicious header can block the event loop for several seconds. Repeated or concurrent submissions keep the process saturated, causing request queuing, timeouts, and potential availability loss across all users of the affected service. The impact is availability-only (C:N/I:N/A:H). There is no described confidentiality or integrity impact and no described memory-corruption or code-execution consequence.

Because no exploit artifacts exist publicly, defenders should treat this as a resource-exhaustion technique and monitor for the input pattern (dense RFC 5322 comments) and for anomalous CPU/event-loop latency rather than for a known payload signature.

Impact Assessment

• CVSS 3.1 base: 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
• Attack Vector (AV:N) — Network: exploitable remotely; no local access required.
• Attack Complexity (AC:L) — Low: no special conditions beyond delivering a crafted header; the vulnerable code path is reached through normal parsing.
• Privileges Required (PR:N) — None: no authentication needed.
• User Interaction (UI:N) — None: the victim does not need to act; parsing of the header is sufficient.
• Scope (S:U) — Unchanged: impact is contained to the vulnerable component's process.
• Confidentiality (C:N) / Integrity (I:N): no data exposure or modification described.
• Availability (A:H) — High: event-loop blocking for several seconds per crafted input can render the service effectively unavailable under repeated or concurrent exploitation.

Blast radius. Because Node.js processes are single-threaded, the effect extends beyond the offending request: every concurrent connection handled by the same process is affected. Microservice deployments that share a process for both outbound email and inbound parsing are especially exposed. Business impact centers on service availability — mail delivery/processing pipelines, notification systems, and customer-facing forms — and the operational cost of request timeouts and potential upstream retry storms.

No EPSS score is available (not yet scored by FIRST.org); no value should be assumed. The vulnerability is not in CISA KEV and no in-the-wild exploitation is currently evidenced in the provided data.

Detection Guidance

Detection for an algorithmic-complexity DoS must focus on anomalous input structure (headers dense in RFC 5322 comments) and on runtime/latency signals (event-loop stalls, CPU saturation) rather than on a fixed exploit string.

Sigma Rule

title: Potential Nodemailer addressparser Algorithmic DoS via RFC 5322 Comment-Heavy Headers
id: 3f7b2c1a-9077-6cve-2026-90776
status: experimental
description: Detects email address/header fields containing an abnormally high density of RFC 5322 comments (parentheses) that may trigger quadratic parsing in Nodemailer addressparser (CVE-2026-90776).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-90776
author: valtersit.com
date: 2026/01/01
logsource:
  category: application
  product: nodemailer
detection:
  selection_comment_density:
    - header|re: '^(\([^)]*\)[\s,]*){8,}'
    - address|re: '(\([^)]*\)){8,}'
  selection_fields:
    header_name:
      - 'From'
      - 'To'
      - 'Cc'
      - 'Bcc'
      - 'Reply-To'
  condition: selection_fields and selection_comment_density
falsepositives:
  - Legitimate mail with many nested comments (rare)
  - Automated list processing with verbose comment annotations
level: medium
tags:
  - attack.t1499
  - cwe.407

YARA Rule

rule CVE_2026_90776_Nodemailer_Addressparser_Comment_DoS
{
    meta:
        description = "Detects RFC 5322 header values with high comment-separated atom density targeting Nodemailer addressparser (CVE-2026-90776)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-90776"
        date = "2026-01-01"
        cwe = "CWE-407"

    strings:
        $hdr_from = "From:" nocase
        $hdr_to   = "To:" nocase
        $hdr_cc   = "Cc:" nocase
        $hdr_bcc  = "Bcc:" nocase
        $cmt_open = "("
        $cmt_clse = ")"

    condition:
        any of ($hdr_*) and
        #cmt_open >= 10 and
        #cmt_clse >= 10 and
        filesize < 64KB
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-90776 Potential Nodemailer addressparser RFC5322 Comment DoS Attempt"; flow:established,to_server; content:"("; depth:0; content:"("; distance:0; content:"("; distance:0; content:"("; distance:0; content:"("; distance:0; content:"("; distance:0; content:"("; distance:0; content:"("; distance:0; content:"("; distance:0; content:"("; distance:0; content:"("; distance:0; pcre:"/(From|To|Cc|Bcc|Reply-To):[^\r\n]*(\([^)]*\)[^\r\n]*){8,}/iH"; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-dos; sid:9077601; rev:1; reference:cve,CVE-2026-90776;)

Elastic Detection

sequence by process.entity_id with maxspan=10s
  [process where event.type == "start" and process.name != null]
  [process where event.action == "cpu_saturation"]

Splunk SPL Query

index=web OR index=mail sourcetype IN ("nodejs","nodemailer","access_combined")
| eval raw=_raw
| eval comment_count = mvcount(split(raw, "("))
| where match(raw, "(?i)(From|To|Cc|Bcc|Reply-To):") AND comment_count >= 10
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, host, uri_path
| where count >= 3
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - count

Wazuh OSSEC Rule

<group name="cve-2026-90776,nodemailer,">
  <rule id="907760" level="10">
    <decoded_as>json</decoded_as>
    <field name="header_name">From|To|Cc|Bcc|Reply-To</field>
    <field name="header_value" type="pcre2">(\([^)]*\)[\s,]*){8,}</field>
    <description>CVE-2026-90776: Possible Nodemailer addressparser RFC 5322 comment flooding (algorithmic DoS) in $(header_name) header</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos,attack.availability,</group>
  </rule>

  <rule id="907761" level="12" frequency="5" timeframe="60">
    <if_matched_sid>907760</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-90776: Repeated Nodemailer addressparser comment-flood attempts from same source (possible DoS campaign)</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos,attack.availability,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No fixed version, vendor advisory reference, or workaround is provided in the available data. The guidance below is defensive and class-appropriate.

1) Immediate mitigations

• Treat all externally supplied email headers as untrusted. Where possible, avoid routing untrusted header content into Nodemailer's addressparser.
• Enforce strict input length limits on header fields and reject or truncate values with excessive RFC 5322 comment nesting/density before they reach the parser.
• Run Node.js mail-processing services with a hard execution time/CPU budget. Deploy process isolation or worker threads (or a reverse-proxy concurrency cap) so a stalled event loop affects only a bounded pool, not the whole service.
• Apply rate limiting per source and per endpoint that accepts email/header input to blunt repeated or concurrent flooding.
• Front mail-processing workloads with a queue so reverse-proxy layers can shed load and return fast errors instead of hanging.

2) Patch / upgrade steps

• No patch exists in the tracked sources. Monitor Nodemailer release channels and the NVD entry for versions beyond 10.0.4 addressing the addressparser complexity issue.
• When a fixed version is published, upgrade Nodemailer past 10.0.4 and re-test parsing of comment-heavy headers.
• Keep dependencies pinned and audited so a fix can be rolled out quickly once available.

3) Long-term hardening

• Adopt secure parsing review practices: reject inputs that trigger superlinear behavior; prefer linear-time parsers and set parser resource ceilings.
• Instrument event-loop latency (e.g., Node.js event-loop lag metrics) and CPU saturation alerts as first-class availability signals, and use the detection rules above.
• Build an SBOM and continuously track Nodemailer and transitive dependencies to identify exposure to versions 9.1.0–10.0.4.
• Fuzz and load-test the header-parsing boundary as part of CI so algorithmic-complexity regressions are caught before release.

References

1. NVD — CVE-2026-90776: https://nvd.nist.gov/vuln/detail/CVE-2026-90776
2. MITRE CWE-407 — Inefficient Algorithmic Complexity: https://cwe.mitre.org/data/definitions/407.html
3. MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
4. Nodemailer project (release/version tracking for a future fix): https://www.npmjs.com/package/nodemailer
5. FIRST.org EPSS (no score currently assigned for this CVE): https://www.first.org/epss/

No threat-actor campaigns or exploit-in-the-wild activity are evidenced for CVE-2026-90776 in the provided data. CISA KEV: NO. Public PoC: None. Nuclei template: NO.