Nodemailer versions 9.1.0 through 10.0. in the addressparser component. When parsing email headers that include RFC 5322 comments, the algorithm consumes excessive CPU cycles, temporarily blocking the Node.js event loop. This results in a denial‑of‑service condition for applications that rely on Nodemailer to send or parse mail.

The vulnerability affects the Nodemailer library distributed via npm. Any deployment that uses Nodemailer versions 9.1.0, 9.2.x, 9.3.x, or 10.0.0 through 10.0.4 is impacted; upgrading to 10.0.5 or later removes the flaw.

The CVSS score of 8.7 classifies this vulnerability as high severity. The EPSS score is not available, and it is not listed in CISA KEV. An attacker can exploit the weakness simply by sending a crafted email containing comment‑separated atoms to a system that parses addresses with Nodemailer. The attack does not require elevated privileges and can block the event loop for several seconds, disrupting service availability.