ZeroDay Findings
Sign inSign up

Findings

CVE-2026-110871

Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding.

Published Oct 14, 2026 · updated Oct 15, 2026 · nodemailer nodemailer

Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers that fold into tens of thousands of continuation lines, blocking the Node.js event loop during DKIM signing.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 14, 2026 · NIST NVD

    Detected

    Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers that fold into tens of thousands of continuation lines, blocking the Node.js event loop during DKIM signing.

  2. Oct 15, 2026 · OSV.dev

    Fix available

    node-nodemailer fixed in 10.0.10+~8.0.1-1

  3. Oct 15, 2026 · OSV.dev

    Fix available

    node-nodemailer fixed in 10.0.10+~8.0.1-1

  4. Oct 15, 2026 · OSV.dev

    Updated

    Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers that fold into tens of thousands of continuation lines, blocking the Node.js event loop during DKIM signing.

Affected

  • Debian:12 node-nodemailer10.0.0+~8.0.1-1, 10.0.10+~8.0.1-1, 10.0.10+~8.0.2-1
  • Debian:13 node-nodemailer10.0.0+~8.0.1-1, 10.0.10+~8.0.1-1, 10.0.10+~8.0.2-1
  • Debian:14 node-nodemailer0 → 10.0.10+~8.0.1-1
  • vendor nodemailer nodemailerversion unspecified

Sources

  • CVE.orgCVE-2026-110871

    Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers that fold into tens of thousands of contin

    cve.org
  • FIRST EPSSCVE-2026-110871

    30-day exploitation probability 0.3%

    first.org
  • NIST NVDCVE-2026-110871

    Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers that fold into tens of thousands of contin

    nvd.nist.gov
  • OSV.devDEBIAN-CVE-2026-110871
    osv.dev

References