medium5.9
CVE-2026-110872
Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection._onData …
Impact
Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection._onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before authentication, blocking the Node.js event loop and exhausting memory.
Affected products
| Product | Affected versions |
|---|---|
| Nodemailer From 3.0.0 | before 10.0.10 |
Versions were read from the advisory text. No structured product data has been published for this record yet.