CVE-2026-92596 nodemailer CVE debrief

Who should care

Defenders responsible for Node.js applications using Nodemailer should assess exposure and prioritize verification and remediation. This includes reviewing application dependencies, monitoring for unusual traffic patterns, and implementing rate limiting on email inputs to mitigate potential attacks. Additionally, security teams and vulnerability management teams should be aware of the potential impact and plan accordingly.

Why it matters

CVE-2026-92596 is a high-severity vulnerability in Nodemailer before version 9.1.0 that can be exploited for denial of service (DoS) via crafted email inputs. Defenders responsible for Node.js applications using Nodemailer should assess exposure and prioritize verification and remediation to prevent potential disruptions.

• Denial of service (DoS) via crafted email inputs
• Potential for extended periods of Node.js event loop blocking
• Consumption of 100% CPU and process freezing

Technical summary

The vulnerability is caused by a quadratic time complexity issue in the addressparser component of Nodemailer before version 9.1.0. This can be exploited by remote attackers to cause a denial of service (DoS) by sending a crafted comma-separated address list in a single email, which can block the Node.js event loop for extended periods, consuming 100% CPU and freezing the process. The issue arises from the inefficient parsing of email addresses, leading to potential disruptions in Node.js applications utilizing Nodemailer.

Defensive priority

Defenders should prioritize verifying if their applications use vulnerable Nodemailer versions and upgrade to version 9.1.0 or later. They should also monitor for unusual traffic patterns and implement rate limiting on email inputs to mitigate potential attacks.

Recommended defensive actions

• Verify if applications use vulnerable Nodemailer versions
• Upgrade to Nodemailer version 9.1.0 or later
• Monitor for unusual traffic patterns
• Implement rate limiting on email inputs
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, including its description, CVSS score, and references to patches and advisories. However, the corpus does not provide information on actual exploitation or victim impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.