{"vulnerability": "GHSA-V53P-9FQP-M79J", "sightings": [{"uuid": "a20d051a-377a-4dec-beef-017d15296d62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-V53P-9FQP-M79J", "type": "seen", "source": "https://gist.github.com/alon710/77ffea7c40677627833ce67b60a06f72", "content": "# GHSA-V53P-9FQP-M79J: GHSA-V53P-9FQP-M79J: Regular Expression Denial of Service (ReDoS) in Nodemailer addressparser\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-29\n> **Full Report:** https://cvereports.com/reports/GHSA-V53P-9FQP-M79J\n\n## Summary\nA Regular Expression Denial of Service (ReDoS) vulnerability exists in Nodemailer's addressparser fallback engine before version 10.0.6. Under specific malformed inputs with excessive word boundaries, the parser exhibits quadratic backtracking, leading to high CPU utilization and event loop blockage.\n\n## TL;DR\nA ReDoS vulnerability in Nodemailer before 10.0.6 allows unauthenticated attackers to cause a remote denial of service by sending crafted email headers that block the single-threaded Node.js event loop.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-1333\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 7.5 (High)\n- **Impact**: Remote Denial of Service (DoS)\n- **Exploit Status**: Proof-of-Concept (PoC)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Nodemailer\n- Node.js applications processing emails\n- **nodemailer**: < 10.0.6 (Fixed in: `10.0.6`)\n\n## Mitigation\n\n- Upgrade to Nodemailer 10.0.6 or higher\n- Implement strict length validation on email headers at the API gateway layer\n- Deploy WAF rules to drop excessively large non-whitespace header sequences\n\n**Remediation Steps:**\n1. Execute 'npm install nodemailer@10.0.6' or 'yarn add nodemailer@10.0.6'\n2. Audit the package lockfile to ensure transitive dependencies are resolved to version 10.0.6+\n3. Implement header length checking logic prior to invoking mail dispatch functions\n\n## References\n\n- [GitHub Advisory Database: GHSA-V53P-9FQP-M79J](https://github.com/advisories/GHSA-V53P-9FQP-M79J)\n- [Nodemailer Release v10.0.6](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.6)\n- [Official Fix Commit](https://github.com/nodemailer/nodemailer/commit/437d7fc47403df176bc39271641541b7a9bce102)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-V53P-9FQP-M79J) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-30T12:30:31.000000Z"}]}