Nodemailer: Quadratic (O(n^2)) DKIM Header Unfolding Lets A Large Folded Header Cause Remote Denial Of Service During Si

Summary When nodemailer DKIM-signs an outbound message, its DKIM message parser unfolds RFC 5322 header continuation lines with a loop that concatenates each continuation line onto the preceding line and then re-tests the anchored regex "/^ \t/" against the growing merged line on every iteration...

npm: Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing

npm: Nodemailer: Quadratic On^2 DKIM header unfolding lets a large folded header cause remote denial of service during signing vulnerability discovered by ? in WordPress npm nodemailer versions = 3.0.0, = 10.0.9...

EUVD-2026-101754

Nodemailer: Quadratic On^2 DKIM header unfolding lets a large folded header cause remote denial of service during signing...

Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing

Summary When nodemailer DKIM-signs an outbound message, its DKIM message parser unfolds RFC 5322 header continuation lines with a loop that concatenates each continuation line onto the preceding line and then re-tests the anchored regex /^ \t/ against the growing merged line on every iteration...

Duplicate Advisory: Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-39m8-27wv-hr27. This link is maintained to preserve external references. Original Description Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that...

GHSA-WXXX-R42M-9RP8 Duplicate Advisory: Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-39m8-27wv-hr27. This link is maintained to preserve external references. Original Description Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that...

PT-2026-122899

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-39m8-27wv-hr27. This link is maintained to preserve external references. Original Description Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that...

UBUNTU-CVE-2026-110871

Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers that fold into tens of thousands of continuation lines,...

DEBIAN-CVE-2026-110871

Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers that fold into tens of thousands of continuation lines,...

CVE-2026-110871

Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers that fold into tens of thousands of continuation lines,...

CVE-2026-110871

Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers that fold into tens of thousands of continuation lines,...

CVE-2026-110871 Nodemailer 3.0.0 before 10.0.10 Quadratic DKIM Header Unfolding Denial of Service

Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers that fold into tens of thousands of continuation lines,...

CVE-2026-110871

The Nodemailer library (versions 3.0.0 to before 10.0.10 ) is vulnerable to a Denial of Service attack via the MessageParser.parseHeaders function. The root cause is quadratic header unfolding , where attackers provide long headers or large recipient lists that expand into tens of thousands of co...

CVE-2026-110871

Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers that fold into tens of thousands of continuation lines,...

CVE-2026-110871 Nodemailer 3.0.0 before 10.0.10 Quadratic DKIM Header Unfolding Denial of Service

Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers that fold into tens of thousands of continuation lines,...

CVE-2026-110871 Nodemailer 3.0.0 before 10.0.10 Quadratic DKIM Header Unfolding Denial of Service

Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers that fold into tens of thousands of continuation lines,...

CVE-2026-110871

Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers that fold into tens of thousands of continuation lines,...

CVE-2026-110871: Uncontrolled Resource Consumption

Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers that fold into tens of thousands of continuation lines,...

Linux Distros Unpatched Vulnerability : CVE-2026-110871

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic...

PT-2026-114185

Name of the Vulnerable Software and Affected Versions Nodemailer versions 3.0.0 through 10.0.9 Description A denial of service issue exists in the MessageParser.parseHeaders function. An attacker can cause CPU exhaustion by providing long headers or large recipient lists that result in quadratic...