Advisory · CVE-2026-110869
Nodemailer flaw lets a hostile SMTP server stall the Node event loop
Nodemailer from 3.0.0 before 10.0.13 has a regular expression denial of service in EHLO handling that a malicious or intercepted SMTP server can trigger. CVSS 4.0 8.7.
- Vendor
- Nodemailer
- Product
- Nodemailer
- Identifier / CWE
- CVE-2026-110869
CWE-1333 - Action timing
- Immediate
Explain it like I’m five
A mail server can answer a greeting with a line crafted to keep the client thinking for a very long time.
- 01SMTP connection opened
A Node.js application using Nodemailer connects to an SMTP server.
- 02Crafted EHLO reply sent
A malicious or man-in-the-middle server replies with the AUTH marker, a long whitespace run, and a non-matching token.
- 03Regex backtracks
The AUTH mechanism detection patterns in EHLO handling backtrack quadratically.
- 04Event loop blocked
The Node.js event loop is blocked for an extended period before authentication.
What happened
The GitHub advisory for Nodemailer describes a regular expression denial of service in releases from 3.0.0 before 10.0.13 in the EHLO handling of SMTP connections. Four AUTH mechanism detection patterns contain overlapping whitespace sub-patterns that backtrack quadratically.
A malicious or man-in-the-middle SMTP server can reply to EHLO with a long whitespace run and a non-matching token, blocking the Node.js event loop for tens of seconds to hours before authentication.
What to do
- Inventory Node.js services that depend on Nodemailer, including indirect dependencies.
- Upgrade Nodemailer to 10.0.13 or later using the project advisory guidance.
- Apply connection and overall job timeouts around outbound mail sending until the upgrade is complete, and avoid untrusted SMTP endpoints.
- Review service logs for mail sends that stalled at connection or greeting stage with high CPU use.
- Verify the resolved dependency version in lockfiles and deployed builds after patching.
Management note
The attacker here is the server, not the client, which makes this easy to overlook in threat models. Any app that can be pointed at an arbitrary SMTP host needs the fix.