ZeroDay Findings
Sign inSign up

Findings

CVE-2026-110869

Nodemailer 3.0.0 before 10.0.13 ReDoS via SMTP AUTH Mechanism Detection Regexes

Published Oct 14, 2026 · updated Oct 15, 2026 · nodemailer nodemailer

Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or man-in-the-middle SMTP server can reply to EHLO with 250-AUTH, a long whitespace run and a non-matching token, blocking the Node.js event loop for tens of seconds to hours before authentication.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 14, 2026 · NIST NVD

    Detected

    Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or man-in-the-middle SMTP server can reply to EHLO with 250-AUTH, a long whitespace run and a non-matching token, blocking the Node.js event loop for tens of second

  2. Oct 15, 2026 · OSV.dev

    Fix available

    node-nodemailer fixed in 10.0.13+~8.0.2-1

  3. Oct 15, 2026 · OSV.dev

    Fix available

    node-nodemailer fixed in 10.0.13+~8.0.2-1

  4. Oct 15, 2026 · OSV.dev

    Updated

    Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or man-in-the-middle SMTP server can reply to EHLO with 250-AUTH, a long whitespace run and a non-matching token, blocking the Node.js event loop for tens of second

  5. Oct 15, 2026 · NIST NVD

    Updated

    Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or man-in-the-middle SMTP server can reply to EHLO with 250-AUTH, a long whitespace run and a non-matching token, blocking the Node.js event loop for tens of second

Affected

  • Debian:12 node-nodemailer10.0.0+~8.0.1-1, 10.0.10+~8.0.1-1, 10.0.10+~8.0.2-1
  • Debian:13 node-nodemailer10.0.0+~8.0.1-1, 10.0.10+~8.0.1-1, 10.0.10+~8.0.2-1
  • Debian:14 node-nodemailer0 → 10.0.13+~8.0.2-1
  • vendor nodemailer nodemailerversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-110869

    Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or man-in-the-middle SMTP server can reply t

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-110869

    30-day exploitation probability 0.3%

    first.org
  • NIST NVDVulnerability recordCVE-2026-110869

    Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or man-in-the-middle SMTP server can reply t

    nvd.nist.gov
  • OSV.devPackage advisoryDEBIAN-CVE-2026-110869
    osv.dev

References