Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms to consume excessive CPU and block the Node.js event loop for several seconds, causing denial of service.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the
    addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious
    email headers with comment-separated atoms to consume excessive CPU and block the Node.js event loop for
    several seconds, causing denial of service. (CVE-2026-90776)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the     addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious     email headers with comment-separated atoms to consume excessive CPU and block the Node.js event loop for     several seconds, causing denial of service. (CVE-2026-90776)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
472997	SCA: security update for nodemailer (GHSA-prgh-xp8r-p3m5)	Tenable Cloud Security	SCA Checks	Local	high
472997	SCA: security update for nodemailer (GHSA-prgh-xp8r-p3m5)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
345463	Linux Distros Unpatched Vulnerability : CVE-2026-90776	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-90776

high

Tenable Plugins

high

high

high