Denial of Service Vulnerability in Nodemailer SMTP Client by Nodemailer

CVE-2026-110872

What is CVE-2026-110872?

A denial of service vulnerability has been identified in Nodemailer, specifically affecting versions prior to 10.0.10. This issue arises from a flaw in the SMTP client reply parser, where a malicious SMTP server or a man-in-the-middle attacker can manipulate the continuation lines without a completion line during the authentication process. Such exploitation can block the Node.js event loop and lead to increased memory consumption, potentially causing service disruption.

References