CVE-2026-110869

Awaiting Analysis Awaiting Analysis - Queue

Regular Expression Denial of Service in Nodemailer

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or man-in-the-middle SMTP server can reply to EHLO with 250-AUTH, a long whitespace run and a non-matching token, blocking the Node.js event loop for tens of seconds to hours before authentication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110869

EUVD

EUVD-2026-101752

Affected Vendors & Products

Vendor	Product	Version / Range
nodemailer	nodemailer	3.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1333	The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

Attack-Flow Graph

Executive Summary

Nodemailer versions 3.0.0 to 10.0.13 have a regular expression denial of service (ReDoS) vulnerability in the SMTPConnection._actionEHLO function. The issue stems from four AUTH mechanism detection regexes that contain overlapping whitespace sub-patterns causing quadratic backtracking. A malicious SMTP server can exploit this by replying to EHLO with a crafted response containing a long whitespace run and a non-matching token, which blocks the Node.js event loop for extended periods before authentication.

Detection Guidance

This vulnerability is specific to Nodemailer versions before 10.0.13 and involves a regex denial of service attack via SMTP AUTH mechanism detection. Detection requires checking the installed Nodemailer version and monitoring for unusual delays in SMTP authentication responses.

Impact Analysis

This vulnerability can cause severe service disruption by freezing the Node.js event loop for tens of seconds to hours. Applications using affected Nodemailer versions may become unresponsive, leading to degraded performance, timeouts, or complete system hangs. It can also enable denial of service attacks against applications relying on Nodemailer for email processing.

Compliance Impact

This vulnerability primarily causes denial of service by blocking the Node.js event loop, which could disrupt services handling sensitive data. While not directly violating GDPR or HIPAA, prolonged downtime may impact availability requirements under these regulations.

Mitigation Strategies

Upgrade Nodemailer to version 10.0.13 or later to address the regular expression denial of service vulnerability in SMTPConnection._actionEHLO.

Hi! I’m here to help you understand CVE-2026-110869. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70