Nodemailer ReDoS in SMTP EHLO Handler Blocks Node Event Loop

Nodemailer, a popular Node.js module for sending email, contains a regular expression denial of service vulnerability in its SMTP connection handler. According to the National Vulnerability Database, this flaw allows a malicious or man-in-the-middle SMTP server to block the Node.js event loop for extended periods. The issue stems from how the library processes the EHLO command response during the initial handshake with a mail server.

Root cause

The vulnerability is classified under CWE-1333, indicating a regular expression denial of service. Inside the SMTPConnection._actionEHLO method, Nodemailer uses four regular expressions to detect available AUTH mechanisms. These patterns contain overlapping whitespace sub-patterns that cause quadratic backtracking when presented with specific inputs. This computational complexity arises when the regex engine attempts to match a long run of whitespace followed by a non-matching token, consuming significant CPU resources.

Attack path

An attacker does not need to authenticate to exploit this flaw. Instead, they control the SMTP server responding to the client's EHLO command. By replying with a "250-AUTH" line containing a long sequence of whitespace characters and a token that does not match any known mechanism, the attacker triggers the backtracking behavior. This action freezes the Node.js event loop, potentially blocking all other operations in the application for tens of seconds or even hours, effectively denying service to legitimate users.

Affected versions

• Nodemailer version 3.0.0
• Nodemailer versions up to 10.0.12
• Any version before 10.0.13 is vulnerable to CVE-2026-110869

Mitigation

• Upgrade Nodemailer to version 10.0.13 or later.
• Verify that all application dependencies are updated to the patched version.
• Monitor SMTP traffic for unusual EHLO responses containing excessive whitespace.
• Implement timeouts for SMTP connections to limit the impact of event loop blocking.

Detection notes

Security operations teams should monitor application logs for unusually long SMTP handshake durations. Look for patterns where EHLO commands are followed by delayed or failed authentication attempts. Check system metrics for spikes in CPU usage correlated with email sending activities. Review network traces for SMTP responses containing excessive whitespace in AUTH lines. Investigate any instances where the Node.js event loop shows significant latency or blocking. Ensure logging captures full SMTP transaction details to identify malicious server behavior.

What to do and how to stay safe: Nodemailer

• Update Nodemailer to version 10.0.13 immediately if you are using an older version.
• Audit your application's SMTP configuration to ensure it connects only to trusted mail servers.
• Implement circuit breakers or timeouts for outbound SMTP connections to mitigate event loop blocking.
• Monitor application performance metrics for signs of event loop congestion during email operations.

Step-by-step guide: Unpatched Software Myths: Why Common Beliefs Fail to Protect You

General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-110869?

It is a regular expression denial of service vulnerability in Nodemailer that allows event loop blocking.

Which versions of Nodemailer are affected?

Versions 3.0.0 through 10.0.12 are affected by this vulnerability.

How can an attacker exploit this flaw?

By controlling an SMTP server and sending a crafted EHLO response with long whitespace runs.