Nodemailer: Quadratic Backtracking In SMTP AUTH Mechanism Detection Regexes Allows Pre-auth Remote Denial Of Service

Summary Nodemailer's SMTP client applies four regular expressions to a peer's EHLO response to detect the supported SASL mechanisms. Each pattern uses an alternation with two overlapping whitespace-matching sub-patterns, which produces quadratic On^2 backtracking whenever the mechanism name is...

GHSA-4FFR-JQ9G-5FFX Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service

Summary Nodemailer's SMTP client applies four regular expressions to a peer's EHLO response to detect the supported SASL mechanisms. Each pattern uses an alternation with two overlapping whitespace-matching sub-patterns, which produces quadratic On^2 backtracking whenever the mechanism name is...

Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service

Summary Nodemailer's SMTP client applies four regular expressions to a peer's EHLO response to detect the supported SASL mechanisms. Each pattern uses an alternation with two overlapping whitespace-matching sub-patterns, which produces quadratic On^2 backtracking whenever the mechanism name is...

Nodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of service

Summary The SMTP client response parser reassembles multiline server replies by appending each continuation line onto a single response-queue entry and re-testing whether that entry is still a partial continuation reply on every line. The partial-response test runs str.slicestr.lastIndexOf'\n' + ...

GHSA-4G23-2XM8-66GC Nodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of service

Summary The SMTP client response parser reassembles multiline server replies by appending each continuation line onto a single response-queue entry and re-testing whether that entry is still a partial continuation reply on every line. The partial-response test runs str.slicestr.lastIndexOf'\n' + ...

EUVD-2026-101755

Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection.onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before...

UBUNTU-CVE-2026-110872

Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection.onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before...

CVE-2026-110872

Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection.onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before...

DEBIAN-CVE-2026-110872

Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection.onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before...

CVE-2026-110872

Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection.onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before...

CVE-2026-110872

The Nodemailer library (versions 3.0.0 before 10.0.10) contains a quadratic complexity denial of service vulnerability within the SMTP client reply parser, specifically affecting SMTPConnection._onData and isPartialResponse. A malicious SMTP server or an on-path attacker can trigger this by strea...

CVE-2026-110872 Nodemailer 3.0.0 before 10.0.10 Denial of Service via SMTP Reply Parsing

Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection.onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before...

CVE-2026-110872

Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection.onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before...

CVE-2026-110872 Nodemailer 3.0.0 before 10.0.10 Denial of Service via SMTP Reply Parsing

Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection.onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before...

CVE-2026-110872 Nodemailer 3.0.0 before 10.0.10 Denial of Service via SMTP Reply Parsing

Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection.onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before...

CVE-2026-110872

Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection.onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before...

PT-2026-114186

Name of the Vulnerable Software and Affected Versions Nodemailer versions 3.0.0 through 10.0.9 Description A quadratic complexity denial of service issue exists in the SMTP client reply parser. A malicious SMTP server or an on-path attacker can stream continuation lines without a completion line...

CVE-2026-110872: Uncontrolled Resource Consumption

Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection.onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before...

Linux Distros Unpatched Vulnerability : CVE-2026-110872

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection.onData an...

CVE-2026-15340

A flaw was found in lwIP. The Simple Mail Transfer Protocol SMTP client does not properly validate the size of inputs, leading to a buffer overflow. A malicious SMTP server could use this flaw to crash or possibly execute arbitrary code with the privileges of the SMTP client by sending an...