CVE-2026-90776: 
Grafana vulnerability analysis and mitigation

CVE-2026-90776 is a denial-of-service vulnerability caused by quadratic time complexity (O(n²)) in the addressparser component of Nodemailer when parsing RFC 5322 comment-separated email address atoms. It affects Nodemailer versions 9.1.0 through 10.0.4 and was disclosed on September 13, 2026. A single crafted ~640 KB address value can block the Node.js event loop for approximately 7 seconds. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, Red Hat CVE).

The root cause is an inefficient algorithmic complexity flaw (CWE-407 / CWE-1333) in src/addressparser/index.ts at the join-check logic within the _handleAddress function. When building an address from many comment-joined atoms (e.g., a@b(c)@b(c)@b(c)...), the parser calls parts[parts.length - 1].slice(-1) on every token to read the last character of the growing accumulator string. Because slice(-1) must flatten the entire accumulated string each time, the operation is O(current length) per token, resulting in O(n²) total parse time. Due to JavaScript's left-to-right || evaluation, the cheaper token.value.charAt(0) check that could short-circuit never executes first. The fix, introduced in commit c07f175, carries the last character of each accumulator run in a separate lastChars record rather than re-reading it from the string, reducing complexity to O(n) (GitHub Advisory, Fix Commit).

Successful exploitation causes the Node.js event loop to block for several seconds per malicious email, rendering the entire application unresponsive during that period. Because Node.js is single-threaded, a handful of back-to-back crafted emails can keep a service continuously unavailable. The vulnerability has no confidentiality or integrity impact, but the availability impact is rated High. Any service that parses inbound email headers using mailparser (which pins nodemailer and passes To/From/Cc headers directly to addressparser without a length cap) is reachable unauthenticated, making this a practical remote DoS for mail-processing applications (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date, and the EPSS score is 0.0 (Red Hat CVE). However, the advisory itself includes a functional PoC demonstrating the issue through both the isolated parser and the end-to-end mailparser path, making independent reproduction straightforward. The attack requires no authentication, no user interaction, and no special privileges — a single crafted email sent to any service parsing inbound mail with mailparser 3.9.24 (which depends on nodemailer 10.0.3) is sufficient. The vulnerability is not listed in the CISA KEV catalog (GitHub Advisory).

1. Identify a target: Locate a service that parses inbound email using mailparser (≥3.9.24 pinned to nodemailer ≤10.0.4) or that directly calls nodemailer/lib/addressparser on attacker-controlled input.
2. Craft the malicious address value: Construct a To (or From/Cc) header value using the comment-joined atom pattern, e.g., a followed by @b(c) repeated ~130,000 times, producing roughly 640 KB of RFC 5322-compliant address data. The payload can be folded at line boundaries under 998 octets to remain standards-compliant.
3. Send the crafted email: Deliver the email to the target service's inbound SMTP endpoint. No authentication is required if the server accepts unauthenticated mail.
4. Trigger the DoS: When the service parses the email, mailparser feeds the malicious header into addressparser, which enters the O(n²) parse loop. The Node.js event loop blocks for ~7 seconds per email (longer for larger payloads — ~18 seconds for ~1 MB).
5. Sustain the attack: Send multiple such emails in rapid succession to keep the event loop continuously blocked, effectively taking the service offline (GitHub Advisory).

• Network: Inbound SMTP messages with abnormally large To, From, or Cc header values (hundreds of kilobytes); headers containing repetitive @domain(comment) patterns.
• Logs: Application logs showing repeated or sustained high-latency email parsing operations; Node.js process appearing unresponsive or timing out during mail ingestion.
• Process: Sustained near-100% CPU usage by the Node.js process correlated with inbound email receipt; event loop lag metrics spiking to several seconds during mail parsing.
• File System: No file-system artifacts expected, as this is a pure CPU/availability attack with no code execution component.

Upgrade Nodemailer to version 10.0.5 or later, which resolves the quadratic complexity by tracking the last character of each accumulator run in a dedicated lastChars record rather than calling slice(-1) on the growing string (v10.0.5 Release, Fix Commit). As interim mitigations, implement input validation to reject or truncate email headers exceeding a reasonable length limit before they reach the parser, and apply rate-limiting on inbound email processing to reduce the impact of repeated attacks. Monitor Node.js event loop lag and CPU utilization in mail-processing services as an early warning signal.

The vulnerability was reported by researcher mmadersbacher and published as GitHub Security Advisory GHSA-prgh-xp8r-p3m5 by Nodemailer maintainer andris9 on September 11, 2026, with a patch released the same day (GitHub Advisory). Red Hat tracked the issue under their CVE advisory system and linked it to Bugzilla entry 2532697 (Red Hat CVE). VulnCheck also published an advisory covering the issue (VulnCheck Advisory). No broader media coverage or notable social media discussion has been identified beyond standard vulnerability database aggregation.