CyberRota Analysis
AI-GeneratedNodemailer versions 9.1.0 through 10.0.4 are vulnerable due to a quadratic time complexity issue in the addressparser component, which can be exploited by attackers through specially crafted email headers containing RFC 5322 comments. This vulnerability can lead to significant CPU consumption, resulting in denial of service by blocking the Node.js event loop for extended periods. Organizations using affected versions should prioritize patching to mitigate the risk of service disruption.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms to consume excessive CPU and block the Node.js event loop for several seconds, causing denial of service.