PT-2026-114186 · Git+1 · Nodemailer
CVSS v4.0
8.2
High
| Vector | AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Nodemailer versions 3.0.0 through 10.0.9
Description
A quadratic complexity denial of service issue exists in the SMTP client reply parser. A malicious SMTP server or an on-path attacker can stream continuation lines without a completion line before authentication, which blocks the Node.js event loop and exhausts memory. This occurs within the
SMTPConnection. onData and isPartialResponse functions.Recommendations
Update to version 10.0.10 or later.
Exploit
Fix
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Nodemailer