https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 01:32:17 +0000 https://vulnerability.circl.lu/vuln/cve-2026-92596 <p><strong>Affected:</strong> nodemailer</p> <p>Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows remote attackers to cause denial of service by supplying a crafted comma-separated address list. Attackers can send a single email with a large number of addresses to block the Node.js event loop for extended periods, consuming 100% CPU and freezing the process.</p> <p><strong>Affected:</strong> nodemailer</p> <p>Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows remote attackers to cause denial of service by supplying a crafted comma-separated address list. Attackers can send a single email with a large number of addresses to block the Node.js event loop for extended periods, consuming 100% CPU and freezing the process.</p> https://vulnerability.circl.lu/vuln/cve-2026-92596 https://vulnerability.circl.lu/vuln/ghsa-2x7j-588g-ccc2 <p><strong>Affected:</strong> npm: nodemailer</p> <p>### Summary</p> <p>Nodemailer&#39;s address parser (`lib/addressparser/index.js`) parses a list of comma‑separated addresses in **quadratic time — O(n²)** in the number of addresses. A single crafted address string (e.g. a `To`, `Cc`, `Bcc`, `From`, or `Reply‑To` value, or any value passed to the exported `addressparser`) therefore consumes CPU proportional to the **square** of its length and blocks Node&#39;s single‑threaded event loop for the entire duration, denying service to every other request in the process.</p> <p>This requires **no special application configuration and no cooperating receiver** — it is entirely inside the parser and triggers on the library&#39;s default code path. A ~1.5 MB address value freezes the process for ~25–30 seconds of 100% CPU; the cost grows with the square of the input, so a few‑MB value stalls the server for minutes. It is a distinct issue from the recursion DoS fixed as CVE‑2025‑14874 (that path is guarded by a nesting‑depth cap; this one is a flat, comma‑separated list with no such limit).</p> <p>### Details</p> <p>`addressparser` tokenizes the input, splits it into per‑address token groups, and then accumulates the parsed results in a loop (`lib/addressparser/index.js`, ~lines 500–505):</p> <p>```js addresses.forEach(addr =&gt; { const handled = _handleAddress(addr, depth); if (handled.length) { parsedAddresses = parsedAddresses.concat(handled); // &lt;-- line ~503 } }); ```</p> <p>`Array.prototype.concat` builds and returns a **new** array containing a copy of ev…</p> <p><strong>Affected:</strong> npm: nodemailer</p> <p>### Summary</p> <p>Nodemailer&#39;s address parser (`lib/addressparser/index.js`) parses a list of comma‑separated addresses in **quadratic time — O(n²)** in the number of addresses. A single crafted address string (e.g. a `To`, `Cc`, `Bcc`, `From`, or `Reply‑To` value, or any value passed to the exported `addressparser`) therefore consumes CPU proportional to the **square** of its length and blocks Node&#39;s single‑threaded event loop for the entire duration, denying service to every other request in the process.</p> <p>This requires **no special application configuration and no cooperating receiver** — it is entirely inside the parser and triggers on the library&#39;s default code path. A ~1.5 MB address value freezes the process for ~25–30 seconds of 100% CPU; the cost grows with the square of the input, so a few‑MB value stalls the server for minutes. It is a distinct issue from the recursion DoS fixed as CVE‑2025‑14874 (that path is guarded by a nesting‑depth cap; this one is a flat, comma‑separated list with no such limit).</p> <p>### Details</p> <p>`addressparser` tokenizes the input, splits it into per‑address token groups, and then accumulates the parsed results in a loop (`lib/addressparser/index.js`, ~lines 500–505):</p> <p>```js addresses.forEach(addr =&gt; { const handled = _handleAddress(addr, depth); if (handled.length) { parsedAddresses = parsedAddresses.concat(handled); // &lt;-- line ~503 } }); ```</p> <p>`Array.prototype.concat` builds and returns a **new** array containing a copy of ev…</p> https://vulnerability.circl.lu/vuln/ghsa-2x7j-588g-ccc2