CVE-2026-110869
7.5HighPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-1333
Impact
A malicious or man-in-the-middle SMTP server can completely freeze your Node.js event loop for hours, causing a denial of service. The attacker needs to control the upstream SMTP server or intercept the unencrypted SMTP connection during the EHLO handshake.
Root cause
Overlapping whitespace sub-patterns in SMTPConnection._actionEHLO authentication regexes trigger catastrophic polynomial backtracking when parsing crafted EHLO responses.
Affected systems
Nodemailer 3.0.0 before 10.0.13
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
Upgrade nodemailer to version 10.0.13 or later. If you cannot patch immediately, ensure all SMTP connections enforce TLS to prevent man-in-the-middle manipulation of EHLO responses, and connect only to trusted SMTP endpoints.
$ npm install nodemailer@^10.0.13AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or man-in-the-middle SMTP server can reply to EHLO with 250-AUTH, a long whitespace run and a non-matching token, blocking the Node.js event loop for tens of seconds to hours before authentication.