Technical impact
A regular expression in nodemailer prior to version 10.0.6 performs quadratic backtracking when parsing the free‑text address portion of email headers. Attackers can craft header values containing long sequences of non‑whitespace characters that force the Node.js event loop to block for several tens of seconds, effectively denying service to legitimate users. The weakness is classified as CWE‑1333, indicating a denial of service that results from heavy computation.
Affected Systems
The vulnerability affects the nodemailer library itself, with all versions earlier than 10.0.6 exposed. It is relevant to any Node.js application that relies on nodemailer to parse or send email messages, regardless of platform or deployment environment. No specific operating system or infrastructure is singled out; the risk exists wherever the vulnerable library is in use.
Risk and Exploitability
The CVSS score of 8.7 denotes high severity, and the EPSS score is currently unavailable, indicating that recent exploitation data is lacking. The vulnerability is not listed in the CISA KEV catalog. Attackers who can supply malicious email headers to a nodemailer‑powered service can trigger the denial of service. The most likely attack vector is remote, via inbound email traffic or an HTTP API that forwards user‑provided email content to nodemailer. Successful exploitation requires only the ability to submit header data; privileged or local access is not a prerequisite.
