ETK-2026-51Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-51",
  "cve_id": null,
  "display_id": "ETK-2026-51",
  "ghsa_id": "GHSA-v53p-9fqp-m79j",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Quadratic parsing denial of service in Nodemailer addressparser",
  "summary": "Nodemailer addressparser can consume excessive CPU when handling specially formed, long address or header strings. An attacker may stall the Node.js process if they can submit data that is passed to address parsing, including inbound mail headers or application-controlled message addresses.",
  "mitigation": "Upgrade nodemailer to version 10.0.6 or later. Until upgraded, restrict and length-limit untrusted values passed as email headers or message addresses.",
  "vendor": "npm",
  "product": "npm:nodemailer",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 10.0.5"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "10.0.6"
      ],
      "package_name": "nodemailer",
      "purl": "pkg:npm/nodemailer"
    }
  ],
  "cwes": null,
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 14.3747947,
  "t0_at": null,
  "signals": {
    "public_poc": {
      "at": "2026-09-29T23:43:36+00:00",
      "days": -21.226477094247684,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T05:09:43.643261+00:00",
      "url": "https://github.com/advisories/GHSA-v53p-9fqp-m79j"
    },
    "trigger_signal": {
      "at": "2026-09-29T23:43:36+00:00",
      "days": -21.226477094247684,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T05:09:43.643261+00:00",
      "url": "https://github.com/advisories/GHSA-v53p-9fqp-m79j"
    }
  }
}