Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms to consume excessive CPU and block the Node.js event loop for several seconds, causing denial of service.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
Most teams treat inbound address headers as cheap to parse. Nodemailer CVE-2026-90776 turns comment-joined To:/From: into a quadratic freeze that can stall Node for about seven seconds on one message. Get mailparser stacks to 10.0.5. https://nvd.nist.gov/vuln/detail/CVE-2026-90776
Post summary
The post describes a denial‑of‑service flaw in Nodemailer (CVE‑2026‑90776) and recommends upgrading to mailparser version 10.0.5 as a remedy.
Nodemailer's remote DoS (CVE-2026-90776) was introduced by the security fix in 9.1.0. No exploitation seen; the patch ships only on 10.x — upgrade to 10.0.5+. https://severitydaily.com/nodemailer-cve-2026-90776-addressparser-quadratic-dos-introduced-9-1-0-fixed-10-0-5/
Post summary
The tweet describes CVE-2026-90776 as a remote DoS introduced by a security fix in Nodemailer 9.1.0, noting that the patch is only available on version 10.x and recommending an upgrade to 10.0.5+.