What’s Vulnerable › Vulnerabilities

CVE-2026-110869: Nodemailer 3.0.0 before 10.0.13 ReDoS via SMTP AUTH Mechanism Detection Regexes

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-14 · updated 2026-10-16
• Weakness: CWE-1333

Description

Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or man-in-the-middle SMTP server can reply to EHLO with 250-AUTH, a long whitespace run and a non-matching token, blocking the Node.js event loop for tens of seconds to hours before authentication.

Affected products

• Npm Nodemailer: from 3.0.0 before 10.0.13 — fixed in 10.0.13
• nodemailer: from 3.0.0 before 10.0.13 — fixed in 10.0.13

How to fix

Upgrade to a fixed version: Npm Nodemailer 10.0.13; nodemailer 10.0.13. Check the vendor advisory for mitigations.

References

• https://github.com/nodemailer/nodemailer/security/advisories/GHSA-4ffr-jq9g-5ffx
• https://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.0.13-redos-via-smtp-auth-mechanism-detection-regexes
• https://github.com/nodemailer/nodemailer/security/advisories/GHSA-4ffr-jq9g-5ffx

Get alerted when CVE-2026-110869 or the next vulnerability affects your stack