CVE-2026-110869

Name of the Vulnerable Software and Affected Versions Nodemailer versions 3.0.0 through 10.0.12

Description A regular expression denial of service exists in the SMTPConnection. actionEHLO() function. The four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that cause quadratic backtracking. A malicious or man-in-the-middle SMTP server can trigger this by replying to EHLO with 250-AUTH, followed by a long sequence of whitespace and a non-matching token, which blocks the Node.js event loop for durations ranging from tens of seconds to several hours before authentication occurs.

Recommendations Update to version 10.0.13 or later.