Nodemailer SMTP Parser Vulnerability Enables Denial of Service
A quadratic complexity flaw in Nodemailer allows attackers to exhaust memory and block event loops during SMTP authentication.
Key points
- The vulnerability affects Nodemailer versions prior to 10.0.10.
- Attackers can exploit the SMTP client reply parser to cause denial of service.
- The issue stems from unbounded continuation lines before authentication completion.
Nodemailer, a widely used Node.js module for sending email, contains a high-severity vulnerability in its SMTP client reply parser. According to the National Vulnerability Database, this flaw allows a malicious server or on-path attacker to trigger a denial of service by exhausting memory and blocking the Node.js event loop. The issue is rated 8.2 on the CVSS scale.
Root cause
The underlying weakness is identified as CWE-400, known as quadratic complexity. The flaw exists within the `SMTPConnection._onData` and `isPartialResponse` functions. These components process server responses during the SMTP handshake. An attacker can manipulate the protocol flow by streaming continuation lines without providing a required completion line. This behavior occurs before the authentication phase is finalized, forcing the parser to handle excessive data growth that degrades system performance.
Attack path
An adversary positioned between the client and the mail server, or operating a malicious SMTP server, can exploit this vulnerability. By sending a stream of partial responses, the attacker prevents the connection from closing or progressing normally. The Node.js runtime continues to process these lines, leading to memory exhaustion. This effectively blocks the event loop, rendering the application unresponsive to legitimate requests and causing a denial of service for the affected service.
Affected versions
- Nodemailer versions starting from 3.0.0.
- All releases up to, but not including, version 10.0.10.
- Any application relying on these vulnerable versions of the library.
Mitigation
- Update Nodemailer to version 10.0.10 or later immediately.
- Review network logs for unusual SMTP traffic patterns.
- Implement rate limiting on outbound SMTP connections if possible.
- Monitor server memory usage for sudden spikes during email operations.
Detection notes
Security teams usually identify this activity by monitoring for unusually long SMTP sessions that fail to complete authentication. Check server logs for repeated continuation lines from remote hosts. Look for sudden increases in memory consumption on the application server without corresponding traffic growth. Verify that outbound connections are not stuck in a pending state. If the event loop freezes, review process metrics for high CPU usage tied to I/O waits. Contain suspected incidents by restarting affected services and isolating compromised network segments.
What to do and how to stay safe: Nodemailer
- Audit your dependency tree to identify any use of Nodemailer versions prior to 10.0.10.
- Apply the latest stable release of the library once the vendor provides an update.
- Monitor application health metrics for signs of event loop blocking or memory leaks.
- Configure alerts for abnormal SMTP connection durations or memory usage spikes.
Step-by-step guide: Unpatched Software Myths: Why Common Beliefs Fail to Protect You
General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the severity of CVE-2026-110872?
The vulnerability is rated as high severity with a CVSS score of 8.2.
Which versions of Nodemailer are affected?
Versions from 3.0.0 up to, but not including, 10.0.10 are affected.
How can an attacker exploit this flaw?
By streaming continuation lines without a completion line during SMTP authentication.
