CVE-2026-38728

An issue in Nodemailer smtpserver before v.3.18.3 allows a remote attacker to cause a denial of service via the SMTPStream.write, lib/smtp-stream.js components...

@cedarjs/studio (>=1.0.0, <=2.0.1), @donswayo/wildduckiu (>=1.30.3, <=1.30.6) +64 more potentially affected by CVE-2026-38728 via smtp-server (>=3.0.1, <=3.18.2)

smtp-server NPM version =3.0.1, =1.0.0, =1.30.3, =1.40.10, =8.0.1, =7.0.0, =1.1.0, =5.8.38, =5.8.40 and more Source cves: CVE-2026-38728 Source advisory: OSV:GHSA-FV2F-RW9F-V9CM...

@cedarjs/studio (>=1.0.0, <=2.0.1), @donswayo/wildduckiu (>=1.30.3, <=1.30.6) +64 more potentially affected by CVE-2026-38728 via smtp-server (>=3.0.1, <=3.18.2)

smtp-server NPM version =3.0.1, =1.0.0, =1.30.3, =1.40.10, =8.0.1, =7.0.0, =1.1.0, =5.8.38, =5.8.40 and more Source cves: CVE-2026-38728 Source advisory: SNYK:JS-SMTPSERVER-17705947...

CVE-2026-38728

An issue in Nodemailer smtpserver before v.3.18.3 allows a remote attacker to cause a denial of service via the SMTPStream.write, lib/smtp-stream.js components...