CVE-2026-92596 Nodemailer before 9.1.0 Denial of Service via addressparser
Remote attackers can cause denial of service in Nodemailer by sending crafted email addresses, blocking the Node.js event loop and consuming CPU resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-92596?
CVE-2026-92596 is a high-severity denial of service vulnerability in nodemailer, published on 16 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows remote attackers to cause denial of service by supplying a crafted comma-separated address list. Attackers can send a single email with a large number of addresses to block the Node.js event loop for extended periods, consuming 100% CPU and freezing the process.
Weakness: CWE-400
Which versions are affected by CVE-2026-92596?
2 open source packages ship an affected version, including nodemailer.
| Package | Affected | Fixed in |
|---|---|---|
nodemailer npm | All versions | 9.1.0 |
nodemailer npm | All versions | 9.1.0 |
How do I fix CVE-2026-92596?
Upgrade nodemailer to 9.1.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-92596 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-92596 exists.
Sources
Also known as CLEANSTART-2026-DX95519, CLEANSTART-2026-NH33763, CLEANSTART-2026-QL18183, CLSA-2026-1791795466, CLSA-2026-1791806342, CLSA-2026-1791814986 and 22 more.