Quadratic Regex Backtracking Causes Remote Denial of Service in nodemailer

nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking behavior. Attackers can supply crafted email header values with long whitespace-free runs to block the Node.js event loop for tens of seconds, causing service unavailability.

• The nodemailer package is affected from version 0 through versions less than 10.0.6.
• The maintainer advisory describes versions through and including 10.0.5 as affected.
• 10.0.6 is the confirmed patched release. The available record does not independently verify the status of every parallel release branch or later version.

The nodemailer package contains a free-text fallback in addressparser that extracts an address when strict parsing finds none. The pattern \s*\b[^@\s]+@[^\s]+\b\s* is executed as a search and has quadratic backtracking behavior. The [^@\s]+ portion can scan to the end of a long run without whitespace or @, after which the engine advances the starting position one character at a time and repeats the scan. Runs with no @, an @ missing its preceding or following part, or a valid address placed after a long run can force repeated scans. The attacker-controlled input is an email header value reaching the parser; this path can occur through mailparser, and can also occur when an application passes a user-controlled string into to, from, or cc address fields while composing through mime-node. Node.js commonly processes JavaScript on a single event loop, so prolonged regex processing can stall the entire process. The available evidence does not identify every integration or transport in each deployment that passes untrusted input into these paths.

The vulnerability is reachable over the network when an application accepts attacker-controlled header values or address strings. The record states that authentication and user interaction are not required and that exploitation has low complexity. A crafted value containing a long whitespace-free run can block the event loop for tens of seconds. The record marks public exploit material as available, and the maintainer advisory includes proof-of-concept material, but it does not identify a campaign, victim, or observed exploitation. Practical reachability still depends on whether a deployment passes untrusted input into addressparser.

An attacker can provide an email header or address string that causes the fallback regex to perform quadratic backtracking and consume CPU for an extended period. The technical result is event-loop blockage, preventing the Node.js process from handling other work normally during the stall. The primary effect is denial of service or reduced availability; the record provides no evidence of confidentiality or integrity loss. If the parser runs inside a process shared by multiple functions, those functions may also be affected, but that secondary scope depends on the deployment architecture and is not confirmed for every installation.

The flaw can stall an email-processing Node.js process for tens of seconds when it receives suitable input. Operational effects may include increased latency, request timeouts, email-processing backlogs, and interruption of mail sending or parsing. In a single-threaded process, one prolonged regex operation may also delay unrelated work waiting on the same event loop, although the exact scope depends on the deployment architecture. The record establishes an availability impact only and does not establish data disclosure, data modification, or access takeover.

1. Upgrade the nodemailer package to the confirmed patched release 10.0.6.
2. After upgrading, verify that the lockfile, build artifact, and runtime all use the patched version rather than only updating the manifest.
3. Prioritize deployments that receive email headers over the network or process user-controlled addresses, because the advisory identifies these as reachable parser paths.
4. If an upgrade cannot be completed immediately, the available evidence does not identify a vendor-provided workaround. Do not treat another release branch as safe solely because 10.0.6 is confirmed patched.

1. Inventory every Node.js application using the nodemailer package and record the runtime version from lockfiles, manifests, or deployed artifacts.
2. Identify deployments using addressparser, mailparser, or mime-node, especially those that process email headers from external sources.
3. Review data flows that pass user-controlled values into to, from, or cc address fields during message composition.
4. Review telemetry for event-loop lag, sudden processing delays, elevated CPU use, or unresponsive service, and correlate those events with unusually large or malformed header or address inputs. This is precautionary monitoring, not a confirmed IOC.
5. Do not treat the absence of log evidence or event-loop stalls as proof that a deployment is safe; complete the version and data-flow checks.