Denial of Service Vulnerability in Nodemailer Affects Multiple Versions
CVE-2026-110871

7.1HIGH

Key Information:

Vendor

Nodemailer

Status
Nodemailer
Vendor
CVE Published:
14 October 2026

What is CVE-2026-110871?

Nodemailer versions prior to 10.0.10 contain a vulnerability in the MessageParser.parseHeaders function, which can be exploited to create a denial of service condition. Attackers are able to craft large recipient lists or extensive headers that may lead to exponential header unfolding. This exploits the Node.js event loop, particularly during DKIM signing, resulting in significant CPU exhaustion. Users of affected versions should update to the latest version to mitigate this risk.

Affected Version(s)

nodemailer 3.0.0 < 10.0.10

nodemailer 10.0.10

References

https://github.com/nodemailer/nodemailer/security/advisor...
vendor-advisory
https://www.vulncheck.com/advisories/nodemailer-3.0.0-bef...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

manus-pi
manus-use
.