Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-110869— Nodemailer 3.0.0 before 10.0.13 ReDoS via SMTP AUTH Mechanism Detection Regexes

Quick assessment

Affected
nodemailer nodemailer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Nodemailer 3.0.0 至 10.0.13（不含）版本在 SMTPConnection._actionEHLO 中存在正则表达式拒绝服务漏洞。该函数中用于检测四种 AUTH 机制的正则表达式包含相互重叠的空格子模式，导致回溯复杂度呈二次方增长。恶意或中间人 SMTP 服务器可通过在 EHLO 响应中返回 250-AUTH、长串空格以及不匹配的令牌，使 Node.js 事件循环阻塞数十秒至数小时，从而在身份验证完成前造成服务中断。

CVSS 7.5 · High EPSS 0.30% · P22

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 2

VendorProduct Version RangeStatus
nodemailer nodemailer 3.0.0< 10.0.13 affected
10.0.13 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-110869

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Nodemailer 3.0.0 before 10.0.13 ReDoS via SMTP AUTH Mechanism Detection Regexes
Source: CVE Program / CVE List V5
Vulnerability Description
Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or man-in-the-middle SMTP server can reply to EHLO with 250-AUTH, a long whitespace run and a non-matching token, blocking the Node.js event loop for tens of seconds to hours before authentication.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1333
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
nodemailer nodemailer 3.0.0 ~ 10.0.13 -

II. Public POCs for CVE-2026-110869

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-110869

请登录查看更多情报信息。

Other References for CVE-2026-110869 (2)

Same Patch Batch · nodemailer · 2026-10-14 · 4 CVEs total

CVE-2026-110871 6.5 MEDIUM Nodemailer 3.0.0 before 10.0.10 Quadratic DKIM Header Unfolding Denial of Service
CVE-2026-110872 5.9 MEDIUM Nodemailer 3.0.0 before 10.0.10 Denial of Service via SMTP Reply Parsing
CVE-2026-110870 5.3 MEDIUM Nodemailer before 10.0.13 Improper Input Validation via Angle-Bracket Address Comments

IV. Related Vulnerabilities

Same product: nodemailer
Same vendor: nodemailer
Same weakness: CWE-1333

V. Comments for CVE-2026-110869

No comments yet

Leave a comment