What’s Vulnerable › Vulnerabilities

CVE-2026-110872: Nodemailer 3.0.0 before 10.0.10 Denial of Service via SMTP Reply Parsing

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-14 · updated 2026-10-16
• Weakness: CWE-400

Description

Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection._onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before authentication, blocking the Node.js event loop and exhausting memory.

Affected products

• Npm Nodemailer: from 3.0.0 before 10.0.10 — fixed in 10.0.10
• nodemailer: from 3.0.0 before 10.0.10 — fixed in 10.0.10

How to fix

Upgrade to a fixed version: Npm Nodemailer 10.0.10; nodemailer 10.0.10. Check the vendor advisory for mitigations.

References

• https://github.com/nodemailer/nodemailer/security/advisories/GHSA-4g23-2xm8-66gc
• https://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.0.10-denial-of-service-via-smtp-reply-parsing
• https://github.com/nodemailer/nodemailer/security/advisories/GHSA-4g23-2xm8-66gc

Get alerted when CVE-2026-110872 or the next vulnerability affects your stack