Regular Expression Denial of Service in Nodemailer SMTP Connection

CVE-2026-110869

What is CVE-2026-110869?

Nodemailer versions prior to 10.0.13 are susceptible to a regular expression denial of service in the SMTPConnection._actionEHLO method. Due to overlapping whitespace sub-patterns in the regex used for AUTH mechanism detection, a malicious or man-in-the-middle SMTP server can exploit this by responding with a long whitespace run followed by a non-matching token, causing significant delays in the Node.js event loop. The result is potential service disruption that can last from seconds to hours, severely impacting service availability.

References