Nodemailer: Regular expression denial of service in SMTP AUTH detection
Summary
Nodemailer, an npm library for sending email from Node.js applications, is affected in versions 3.0.0 up to 10.0.12. A malicious or man-in-the-middle SMTP server can answer the EHLO command with a long whitespace run, which causes quadratic regex backtracking. This blocks the Node.js event loop for tens of seconds up to hours, and the attack needs no credentials because it occurs before authentication.
Affected
- Nodemailer (npm) 3.0.0 up to and including 10.0.12
Fixed in
- Nodemailer 10.0.13 or later
Workaround
Unknown. No vendor workaround is documented. Until patching, restrict outbound SMTP to trusted relays you configure yourself and use TLS on the relay path.
Exploitation
- No exploitation in the wild was found at the time of research.
- A proof of concept is included in the vendor advisory. CISA SSVC lists exploitation as PoC and automatable as yes.
- CISA KEV status was not verified.
Our recommendation
- Inventory Node.js projects and lockfiles for nodemailer versions below 10.0.13, including transitive dependencies.
- Upgrade to 10.0.13 or later, preferably the latest 10.x release.
- Prioritise services that connect to SMTP servers on untrusted networks or to tenant-configured hosts.
- Monitor mail-sending services for stalls or unexplained high CPU usage.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-4ffr-jq9g-5ffx github.com
- VulnCheck advisory for CVE-2026-110869 www.vulncheck.com
- OSV record GHSA-4ffr-jq9g-5ffx osv.dev
- GitLab Advisory Database entry for nodemailer advisories.gitlab.com
- OSV record for Debian CVE-2026-110869 osv.dev
- OSV record for Ubuntu CVE-2026-110869 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:42.
Original description (NVD)
Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or man-in-the-middle SMTP server can reply to EHLO with 250-AUTH, a long whitespace run and a non-matching token, blocking the Node.js event loop for tens of seconds to hours before authentication.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.