THREAT OPS › Threat News › [GHSA] GHSA-2x7j-588g-ccc2 (high) — Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list
[GHSA] GHSA-2x7j-588g-ccc2 (high) — Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list
GHSA-2x7j-588g-ccc2 Severity: high CVE: None
Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list
### Summary
Nodemailer's address parser (`lib/addressparser/index.js`) parses a list of comma‑separated addresses in **quadratic time — O(n²)** in the number of addresses. A single crafted address string (e.g. a `To`, `Cc`, `Bcc`,
Indicators of compromise
- a@b.comemail
- c@d.comemail
Original source: https://github.com/advisories/GHSA-2x7j-588g-ccc2