Vulnerability	Vulnerable Version
H Inefficient Algorithmic Complexity nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in its address parser (`src/addressparser/index.ts`), whose join condition evaluates `parts[parts.length - 1].slice(-1)` before the cheaper `token.value.charAt(0)` check, flattening the accumulator on every token and making the parse quadratic in the length of the address value. An attacker can block the Node.js event loop for roughly 7 seconds per message, stalling all other work on it, by supplying an address value of about 640 KB whose atoms are separated by RFC 5322 comments, such as `a@b(c)@b(c)@b(c)...`. This requires the application to parse untrusted addresses, which is reachable through mailparser wherever inbound email headers are processed. How to fix Inefficient Algorithmic Complexity? Upgrade `nodemailer` to version 10.0.5 or higher.	>=9.1.0 <10.0.5

Inefficient Algorithmic Complexity

nodemailer is an Easy as cake e-mail sending from your Node.js applications

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in its address parser (src/addressparser/index.ts), whose join condition evaluates parts[parts.length - 1].slice(-1) before the cheaper token.value.charAt(0) check, flattening the accumulator on every token and making the parse quadratic in the length of the address value. An attacker can block the Node.js event loop for roughly 7 seconds per message, stalling all other work on it, by supplying an address value of about 640 KB whose atoms are separated by RFC 5322 comments, such as a@b(c)@b(c)@b(c).... This requires the application to parse untrusted addresses, which is reachable through mailparser wherever inbound email headers are processed.

How to fix Inefficient Algorithmic Complexity?

Upgrade nodemailer to version 10.0.5 or higher.

>=9.1.0 <10.0.5

Go back to all versions of this package