CVE-2026-110872: Nodemailer 3.0.0 before 10.0.10 Denial of Service via SMTP Reply Parsing
Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection.onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before authentication, blocking the Node.js event loop and exhausting memory.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this denial-of-service issue?
Applications using npm/nodemailer versions from 3.0.0 through versions before 10.0.10 are exposed when they connect to an SMTP server that can send crafted reply data. The affected code is in Nodemailer's SMTP client reply parsing.
What does an attacker need to exploit it?
An attacker must be able to act as a malicious SMTP server or interfere with the SMTP connection on path. They can stream SMTP continuation lines without a completion line, and exploitation can occur before authentication.
Is authentication required for exploitation?
No. The malicious reply stream can be processed before SMTP authentication, so no SMTP credentials or authenticated session are required.
What is the operational impact?
The crafted responses trigger quadratic parsing behavior, which can block the Node.js event loop and exhaust memory. This results in a denial of service rather than confidentiality or integrity impact.