CVE-2026-92596

Executive Summary

CVE-2026-92596 is a quadratic time complexity (algorithmic complexity) vulnerability in the addressparser component of Nodemailer prior to version 9.1.0. Remote, unauthenticated attackers can send a single email containing a large, crafted comma-separated address list, causing excessive CPU consumption that blocks the Node.js event loop and freezes the affected process. Any application using an affected Nodemailer version to parse inbound or outbound email addresses is potentially impacted, resulting in a denial-of-service condition rated CVSS 7.5 (High).

Technical Analysis

Nodemailer is a widely used Node.js library for sending and processing email. The vulnerability resides in its addressparser component, which parses address lists such as those found in the To:, Cc:, or Bcc: headers of an email or in address strings supplied programmatically.

The root cause is a quadratic time complexity (O(n²)) parsing algorithm. When addressparser processes a crafted comma-separated address list, the execution time scales disproportionately with input size — roughly quadratically. A moderately sized but specially structured list can therefore trigger a disproportionately large amount of CPU work.

Because Node.js executes JavaScript on a single-threaded event loop, a long-running synchronous parsing operation monopolizes the event loop. This produces the following observable effects described in the NVD entry:

• Sustained 100% CPU utilization on the affected core.
• Blocking of the Node.js event loop, preventing the process from servicing other requests or timers.
• Freezing of the process, effectively denying service to legitimate users.

This class of defect (CWE-400, Uncontrolled Resource Consumption) is triggered purely by the structure and size of the input to addressparser; no authentication is required (PR:N), no user interaction is needed beyond the target processing the crafted address list (UI:N), and the attack is network-reachable (AV:N). Confidentiality and integrity are unaffected (C:N/I:N); the sole impact is availability (A:H), giving the CVSS 3.1 base score of 7.5.

No CNA-provided title, affected version list, or package metadata was supplied in the intelligence feed. The exact internal code path (e.g., which loop or sub-function in addressparser exhibits the quadratic behavior) is not disclosed in the provided description and is therefore not asserted here. The vulnerability is characterized at the level of its documented class: algorithmic complexity in address parsing.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for CVE-2026-92596. The following attack chain is inferred strictly from the vulnerability class and the NVD description.

1. Reconnaissance / Target Identification. The attacker identifies a target that uses Nodemailer (version < 9.1.0) to parse email address lists. This includes mail-handling web services, ticketing/contact-form backends, or any Node.js application that ingests user-supplied address strings into addressparser.

2. Triggering the Flaw. Because the flaw is triggered by the size and structure of a comma-separated address list, the attacker supplies a crafted address list — for example by sending a single email whose address headers contain a very large number of addresses, or by submitting such a string to an input field that is passed to addressparser. The NVD description explicitly states the vector is "a single email with a large number of addresses."

3. Execution / Payload (vulnerability-class level). The crafted input causes addressparser to perform an amount of work that grows approximately quadratically with input length. Each parse consumes progressively more CPU time; a sufficiently large list blocks the Node.js event loop. The attacker needs no credentials and no special privileges — only the ability to deliver input that reaches the vulnerable parsing routine.

4. Post-Exploitation Impact. The receiving Node.js process pins a CPU core at 100% and its event loop stalls, freezing the process and denying service to legitimate traffic. Repeated delivery of such inputs (or a single sufficiently large one) sustains the outage. Because processing is synchronous and on the event loop, other requests handled by the same process are starved until parsing completes or the process is restarted.

No public PoC is available; the attack chain above is inferred from the vulnerability class (algorithmic complexity / uncontrolled resource consumption) and the documented trigger (crafted comma-separated address list).

Impact Assessment

• Availability (A:H): Primary impact. A single crafted input can freeze the Node.js process, causing a full denial of service for the affected service.
• Confidentiality (C:N) / Integrity (I:N): No disclosure or modification of data is implied by the description.
• Attack Vector (AV:N) / Complexity (AC:L) / Privileges (PR:N) / User Interaction (UI:N): Trivially reachable over the network, low complexity, no authentication, no user interaction — a classic low-barrier DoS.
• Scope (S:U): Impact is confined to the vulnerable component's process.
• Base Score: 7.5 (High).

Blast radius. Any Node.js service, API gateway, mail relay, contact/ticket ingestion pipeline, or scheduled job using Nodemailer < 9.1.0 that parses attacker-influenced address strings. Because the event loop is single-threaded, a single blocked parse can stall all concurrent work in that process — amplification beyond the immediately affected feature. In horizontally scaled deployments, repeated attacks can degrade the whole pool; in single-instance deployments, it is a complete outage. There is no evidence of in-the-wild exploitation, CISA KEV listing, or associated threat actor campaign. EPSS has not been scored by FIRST.org.

Detection Guidance

Sigma Rule

title: Potential Nodemailer addressparser Quadratic Complexity DoS
id: 7b2c9f41-3e6a-4d5b-9a10-92596nodemailer
status: experimental
description: Detects anomalous volumes of comma-separated email addresses or excessive CPU-bound parsing consistent with CVE-2026-92596 (Nodemailer < 9.1.0 addressparser O(n^2) DoS).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-92596
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - cwe.400
logsource:
  category: application
  product: nodemailer
detection:
  selection_many_addresses:
    event:
      - 'mail.received'
      - 'address.parse'
    address_count|gte: 100
  selection_eventloop_stall:
    event: 'node.eventloop.lag'
    lag_ms|gte: 5000
  condition: selection_many_addresses or selection_eventloop_stall
falsepositives:
  - Legitimate large mailing lists processed in bulk
  - Batch ingestion of recipient lists
level: high

YARA Rule

rule CVE_2026_92596_Nodemailer_Addressparser_DoS
{
    meta:
        author = "valtersit.com"
        description = "Heuristic detection of oversized comma-separated address lists indicative of Nodemailer addressparser DoS (CVE-2026-92596)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-92596"
        date = "2026-01-01"
    strings:
        $addr = /[A-Za-z0-9._%+\-]+@[A-Za-z0-9.\-]+\.[A-Za-z]{2,}/
    condition:
        // High density of email-address-like tokens separated by commas.
        #addr > 100 and uint16(0) == 0x0a0d
}

Suricata IDS Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2026-92596 Nodemailer addressparser excessive address list DoS attempt"; flow:established,to_server; content:"@"; content:","; content:"@"; distance:0; pcre:"/(?:[A-Za-z0-9._%+\-]+@[A-Za-z0-9.\-]+\.[A-Za-z]{2,},){100,}/sm"; classtype:attempted-dos; reference:cve,2026-92596; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-92596; sid:2026092596; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=30s
  [process where process.name == "node"]
  [process where process.name == "node" and
     (process.cpu_pct >= 95 or event.action == "eventloop_lag") and
     process.command_line : "*nodemailer*"]

Splunk SPL Query

index=node OR index=app sourcetype=nodemailer*
| eval addr_count = mvcount(split(address_list, ","))
| where addr_count >= 100 OR eventloop_lag_ms >= 5000
| stats count, max(addr_count) as max_addrs, max(eventloop_lag_ms) as max_lag by host, source
| where max_addrs >= 100 OR max_lag >= 5000
| sort - max_addrs

Wazuh OSSEC Rule

<group name="nodemailer,cve-2026-92596,">
  <rule id="100596" level="10">
    <decoded_as>json</decoded_as>
    <field name="event">address\.parse|mail\.received</field>
    <field name="address_count" type="pcre2">\b(?:[1-9][0-9]{2,})\b</field>
    <description>CVE-2026-92596: Suspicious large comma-separated address list parsed by Nodemailer addressparser (possible DoS)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
  <rule id="100597" level="12">
    <decoded_as>json</decoded_as>
    <field name="event">eventloop\.lag</field>
    <field name="lag_ms" type="pcre2">^(?:\d{4,}|\d{2,}\d{3,})$</field>
    <description>CVE-2026-92596: Node.js event loop stall consistent with addressparser algorithmic complexity DoS</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix reference, workaround, or affected-version list was provided in the intelligence feed.

1. Immediate mitigations

• Upgrade Nodemailer to 9.1.0 or later, which the NVD description identifies as the version in which the issue is resolved ("Nodemailer before 9.1.0"). Treat this as the primary remediation based on the description.
• If immediate upgrade is not possible, bound and validate the size of any address list (header or programmatic string) before it reaches addressparser. Reject inputs exceeding a conservative maximum number of addresses or characters.
• Rate-limit and quota inbound email and API endpoints that feed address parsing, reducing the ability to deliver large crafted lists.
• Run Node.js mail/parsing workloads as isolated, individually restartable processes (or workers) so a single blocked event loop does not take down all functionality; configure health checks and automatic restarts.

2. Patch / upgrade steps

• Update the dependency to nodemailer@>=9.1.0 in package.json and regenerate the lockfile (npm install nodemailer@latest).
• Verify the resolved version across all transitive dependencies with npm ls nodemailer.
• Redeploy and restart all Node.js services that parse address data; confirm no cached/stale versions remain.

3. Long-term hardening

• Add automated dependency scanning (SCA) and alerting for nodemailer version drift.
• Instrument the Node.js event loop with lag monitoring to detect future CPU-bound parsing regressions.
• Perform complexity/input-size review of parser-facing code paths; prefer bounded, streaming, or linear-time parsing for untrusted input.
• Enforce strict input-size limits at the edge (reverse proxy / mail gateway) for all address-bearing fields.

References

• NVD — CVE-2026-92596: https://nvd.nist.gov/vuln/detail/CVE-2026-92596
• Nodemailer project (vendor): https://nodemailer.com/
• Nodemailer source repository (addressparser component): https://github.com/nodemailer/nodemailer
• CWE-400 — Uncontrolled Resource Consumption: https://cwe.mitre.org/data/definitions/400.html
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-92596 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (no score available for CVE-2026-92596): https://www.first.org/epss/

Exploit-in-the-wild / threat actor note: No PoC, exploit code, Nuclei template, CISA KEV entry, or attributed threat actor campaign is associated with CVE-2026-92596 based on the data provided. All detection content above is heuristic and based on the documented vulnerability class, not on observed exploitation.