CVE-2026-110872GHSA-4g23-2xm8-66gc
Nodemailer 3.0.0 before 10.0.10 Denial of Service via SMTP Reply Parsing
nodemailer nodemailer
CVSS
8.2HighExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 15 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.29%Chance of exploitation activity in the next 30 days, higher than 20% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 10.0.10nodemailerCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection._onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before authentication, blocking the Node.js event loop and exhausting memory.
Text from CVE List
Affected versions 2
- nodemaileraffected: 3.0.0 before 10.0.10CVE List
- nodemailerunaffected: 10.0.10CVE List