CVE-2026-110871

Name of the Vulnerable Software and Affected Versions Nodemailer versions 3.0.0 through 10.0.9

Description A denial of service issue exists in the MessageParser.parseHeaders() function. An attacker can cause CPU exhaustion by providing long headers or large recipient lists that result in quadratic header unfolding, which creates tens of thousands of continuation lines. This process blocks the Node.js event loop during DKIM signing, where DKIM (DomainKeys Identified Mail) is a method used to detect email spoofing.

Recommendations Update to version 10.0.10 or later.