Nodemailer: Quadratic (O(n²)) time complexity in addressparser
Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list. Nodemailer's address parser (lib/addressparser/index.js) parses a list of comma‑separated addresses in quadratic time — O(n²) in the number of addresses.
- Severity
- HighCVSS 7.5
- Fix
- Fixed in 9.1.0Fix recorded 2 days ago
- Affected versions
- before 9.1.0
- Affects
- nodemailer
What to do
Run this in the application environment you want to check:
npm ls --all nodemailerUpdate to 9.1.0 or later.
References
- github.com · v9.1.0 (tag) patch release notes
- github.com · GHSA-2x7j-588g-ccc2 vendor advisory
- github.com · PR #1848 GitHub Advisory
- github.com · commit 34da642 GitHub Advisory
- github.com · commit 7cc38af GitHub Advisory
- github.com · commit 9116da9 GitHub Advisory