A quadratic time complexity vulnerability in the Nodemailer addressparser component allows unauthenticated attackers to cause a denial of service by blocking the Node.js event loop.

The vulnerability exists within the address parsing logic, specifically when handling RFC 5322 comments. An unauthenticated attacker can supply specially crafted email headers containing comment-separated atoms to trigger excessive CPU consumption, effectively freezing the Node.js event loop.

Successful exploitation results in a denial of service, which can render applications utilizing Nodemailer unresponsive. Because this vulnerability targets the Node.js event loop, it can impact the availability of the entire application process rather than just the email parsing function. With a CVSS score of 7.5, this represents a significant risk to service continuity and operational stability for any platform handling external email inputs.

Immediate Action: Update the Nodemailer package to version 10.0.5 or later, which contains the necessary algorithmic improvements to address the quadratic complexity issue.

Proactive Monitoring: Monitor server CPU utilization and Node.js event loop latency for sudden spikes that correlate with incoming email processing requests.

Compensating Controls: Implement input validation or size limits on email header fields at the Web Application Firewall or proxy level to prevent excessively large or complex address strings from reaching the application.

Public Exploit Available: Unknown

This high-severity vulnerability poses a direct threat to application availability. Administrators should prioritize updating the Nodemailer dependency to version 10.0.5 immediately to eliminate the risk of service disruption. If an immediate update is not feasible, ensure that rigorous input sanitization is applied to all email headers before they are processed by the addressparser component.