Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2026-92596 →
DEBIAN-CVE-2026-92596
Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows remote attackers to cause denial...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows remote attackers to cause denial of service by supplying a crafted comma-separated address list. Attackers can send a single email with a large number of addresses to block the Node.js event loop for extended periods, consuming 100% CPU and freezing the process.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
node-nodemailer
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:13
node-nodemailer
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:14
node-nodemailer
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.0+~8.0.1-1"}]}]
Références
- advisory security-tracker.debian.org