CVE-2026-110869
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or man-in-the-middle SMTP server can reply to EHLO with 250-AUTH, a long whitespace run and a non-matching token, blocking the Node.js event loop for tens of seconds to hours before authentication.
Risk Assessment
Blocking the Node.js event loop causes the application using Nodemailer to hang, potentially paralyzing mail-sending services and other functions dependent on that process.
Recommendation
Update Nodemailer to version 10.0.13 or later. Consider enforcing encrypted SMTP connections to make man-in-the-middle attacks harder.
Other vulnerabilities in Nodemailer
See all- GHSA-2x7j-588g-ccc2High
Nodemailer's address parser parses comma-separated addresses in quadratic time (O(n²)) in the number of addresses. A single crafted address string (e.g., To, Cc, Bcc, From, Reply-To) can cause significant slowdown.
- GHSA-4g23-2xm8-66gcMedium
Nodemailer's SMTP client response parser reassembles multiline server replies by appending each continuation line onto a single response-queue entry and re-testing whether it is still a partial reply on every line. The partial-response test performs string operations per line, which can lead to inefficient processing.
- GHSA-g73g-hqqh-jr95Medium
Nodemailer's address parser has three published, patched fixes for RFC 5322 comment handling inside an addr-spec. The description covers earlier issues with glued domain atoms and quoted local parts, plus related ReDoS fixes.
- GHSA-268h-hp4c-crq3Medium
A vulnerability in the Nodemailer library allows header injection via the `list.*.comment` field, which is not sanitized for CR (`\r`) and LF (`\n`) characters. An attacker can supply a malicious value in this field, leading to email header spoofing.
- GHSA-wqvq-jvpq-h66fMedium
A vulnerability in Nodemailer allows bypassing the `disableFileAccess` and `disableUrlAccess` options when using `jsonTransport`. While the normal MIME streaming path enforces these restrictions, `jsonTransport` serializes the message in a way that bypasses them, potentially enabling access to local files or external URLs.
- GHSA-p6gq-j5cr-w38fHigh
In nodemailer v9.0.0, the message-level `raw` option bypasses `disableFileAccess` and `disableUrlAccess` protections, enabling arbitrary file reads and full SSRF (Server-Side Request Forgery) in the sent message.
- GHSA-r7g4-qg5f-qqm2Medium
Nodemailer disables TLS certificate verification in its internal HTTPS fetch client by setting rejectUnauthorized: false in lib/fetch/index.js. This causes OAuth2 token requests to trust invalid or self-signed HTTPS certificates.
- GHSA-8vvx-rff5-p5rqMedium
A vulnerability exists in the nodemailer package (npm) affecting versions from 2.7.2 to 10.0.1. Details are not fully described in the provided snippet, but vulnerable versions are confirmed.
- GHSA-4ffr-jq9g-5ffxMedium
Nodemailer's SMTP client applies four regular expressions to a peer's EHLO response to detect supported SASL mechanisms. Each pattern uses overlapping whitespace-matching sub-patterns, producing quadratic (O(n^2)) backtracking on long mechanism names.
- GHSA-8m3c-c648-2xjjMedium
Nodemailer's disableFileAccess/disableUrlAccess options are a security sandbox that forbids untrusted message content from reading local files or making outbound HTTP(S) requests. The fix for GHSA-wqvq-jvpq-h66f may be incomplete, allowing bypass of the sandbox.
Original NVD description (English source)
Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or man-in-the-middle SMTP server can reply to EHLO with 250-AUTH, a long whitespace run and a non-matching token, blocking the Node.js event loop for tens of seconds to hours before authentication.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS