CVE-2026-110869: Nodemailer 3.0.0 before 10.0.13 ReDoS via SMTP AUTH Mechanism Detection Regexes
Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection.actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or man-in-the-middle SMTP server can reply to EHLO with 250-AUTH, a long whitespace run and a non-matching token, blocking the Node.js event loop for tens of seconds to hours before authentication.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue in practice?
An attacker must control the SMTP server Nodemailer connects to, or be able to act as a man-in-the-middle for that SMTP connection. The malicious server sends a crafted EHLO response containing a 250-AUTH line with a long whitespace sequence followed by a non-matching token.
Does exploitation require SMTP credentials or user interaction?
No. The listed vector is network-accessible with low attack complexity, no privileges, and no user interaction. The crafted response is processed during EHLO before authentication.
What is the operational impact?
Processing the crafted AUTH mechanism response can cause quadratic regular-expression backtracking in SMTPConnection._actionEHLO. This blocks the Node.js event loop for tens of seconds to hours, causing a denial of service without affecting confidentiality or integrity.
Which Nodemailer versions are affected?
Nodemailer versions from 3.0.0 up to, but not including, 10.0.13 are affected. Updating to 10.0.13 or later removes the affected version range.