CVE-2026-92596: 
Grafana vulnerability analysis and mitigation

CVE-2026-92596 is a quadratic time complexity (O(n²)) denial-of-service vulnerability in the addressparser component of Nodemailer, a popular Node.js email library. It affects all Nodemailer versions before 9.1.0 and was published on September 16, 2026, with the fix released in version 9.1.0. An unauthenticated remote attacker can supply a crafted comma-separated address list to block the Node.js event loop for extended periods, consuming 100% CPU. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, Feedly).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption) and CWE-1050 (Excessive Platform Resource Consumption within a Loop). In lib/addressparser/index.js (~lines 500–505), the parser accumulates parsed results using parsedAddresses = parsedAddresses.concat(handled) inside a forEach loop over each address. Because Array.prototype.concat creates a new array copying all previously accumulated elements on every iteration, processing n addresses performs 1+2+3+…+n total copy operations — O(n²) work. A second quadratic path existed in the display-name merge loop (using splice), and a third in MimeNode#_convertAddresses, which used a linear scan (Array.some) per address for recipient deduplication. The vulnerability is triggered on the normal send path via any structured address header (To, Cc, Bcc, From, Reply-To) or directly through the exported require('nodemailer/lib/addressparser') function. A public PoC is available in the security advisory (GitHub Advisory, Commit 9116da9).

Successful exploitation causes complete denial of service for the affected Node.js process. A ~1.5 MB crafted address string (e.g., 'a@b.com,'.repeat(200000)) blocks the single-threaded Node.js event loop for approximately 25–30 seconds at 100% CPU, preventing all other requests from being processed during that window. Because the cost grows quadratically, a few-MB payload can stall the server for minutes. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue affecting any service that processes user-controlled email address fields (GitHub Advisory).

A public proof-of-concept JavaScript script is available in the Nodemailer security advisory, demonstrating the DoS by directly calling the vulnerable addressparser function with crafted payloads. The exploit requires no authentication, no special configuration, and no cooperating receiver — it triggers on the library's default code path. The NVD SSVC assessment classifies exploitation as automatable with a PoC status. The EPSS score is 0.0 at time of publication, and there is no evidence of in-the-wild exploitation or CISA KEV catalog listing as of the advisory date (GitHub Advisory, Feedly).

1. Identify target: Locate a service running Nodemailer < 9.1.0 that accepts user-controlled input in email address fields (e.g., a "send email," "invite," or "share" feature), or that directly calls require('nodemailer/lib/addressparser') with untrusted input.
2. Craft the malicious payload: Generate a large comma-separated address string, e.g., const payload = 'a@b.com,'.repeat(200000); — approximately 1.5 MB. For distinct-recipient paths, use unique addresses to also trigger the O(n²) deduplication path.
3. Deliver the payload: Submit the crafted string as the To, Cc, Bcc, From, or Reply-To field of an email send request, or pass it directly to the exported addressparser function. Example via the send API: transport.sendMail({ from: 'a@b.com', to: 'a@b.com,'.repeat(150000), subject: 'x', text: 'y' });
4. Trigger quadratic parsing: The addressparser function processes the input synchronously, executing O(n²) array copy operations via parsedAddresses.concat(handled) on each of the n iterations.
5. Achieve denial of service: The Node.js event loop is blocked for 25–30+ seconds at 100% CPU, freezing all other request processing. Repeating the request maintains the DoS condition (GitHub Advisory).

• Logs: Application logs showing requests to email-sending endpoints with unusually large To, Cc, Bcc, From, or Reply-To header values (megabyte-scale strings); Node.js process logs showing extended unresponsiveness or timeout errors coinciding with email send operations.
• Process/System: Sustained 100% CPU utilization on the Node.js process for 15–30+ second intervals with no corresponding increase in throughput; event loop lag metrics spiking to tens of seconds; health check endpoints becoming unresponsive during parsing.
• Network: Inbound HTTP requests containing address fields with thousands of comma-separated entries (e.g., repeated a@b.com, patterns); unusually large request body sizes (>1 MB) directed at email-related API endpoints (GitHub Advisory).

Upgrade Nodemailer to version 9.1.0 or later, which fixes all three quadratic paths: the concat-based accumulator in addressparser (commit 9116da9), the linear-scan recipient deduplication in MimeNode#_convertAddresses (commits 7cc38af, 34da642), and the concat.apply stack overflow in _parseAddresses (commit 83b8c48). Version 9.1.0 also introduces a maxRecipients option (default 100,000) that throws rather than truncating on oversized lists. As an interim workaround, implement rate limiting and enforce a maximum number of recipients per request at the application layer before passing values to Nodemailer, and monitor CPU usage for unexplained spikes (GitHub Advisory).

The vulnerability was reported by security researcher e1abrador and credited in the official advisory. The Nodemailer maintainer (andris9) published the fix in version 9.1.0 with detailed commit messages explaining each of the three quadratic paths addressed. Red Hat tracked the issue via Bugzilla (bug 2536015) and published a CVE advisory, indicating downstream package maintainers are actively evaluating impact (GitHub Advisory, Red Hat).