CVE-2026-110871

Awaiting Analysis Awaiting Analysis - Queue

Denial of Service in Nodemailer via Header Parsing

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: VulnCheck

Description

Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers that fold into tens of thousands of continuation lines, blocking the Node.js event loop during DKIM signing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110871

EUVD

EUVD-2026-101754

Affected Vendors & Products

Vendor	Product	Version / Range
nodemailer	nodemailer	3.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

Nodemailer versions from 3.0.0 to 10.0.10 have a denial of service vulnerability in the MessageParser.parseHeaders function. Attackers can exploit this by sending emails with large recipient lists or long headers that unfold into many continuation lines, causing the Node.js event loop to block during DKIM signing and exhaust CPU resources.

Detection Guidance

To detect this vulnerability, monitor for unusual CPU usage spikes during email processing, especially when handling messages with large recipient lists or long headers. Check Node.js applications using Nodemailer for event loop delays or timeouts during DKIM signing operations.

Impact Analysis

This vulnerability can cause your application to become unresponsive or crash due to high CPU usage. It may disrupt email processing, slow down or halt other services running on the same Node.js event loop, and potentially lead to service outages if exploited repeatedly.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by causing service disruptions due to CPU exhaustion from malicious header inputs. Denial of service conditions may lead to prolonged unavailability of email services, potentially violating availability requirements under these regulations.

Mitigation Strategies

Immediately update Nodemailer to version 10.0.10 or later. If immediate update is not possible, implement input validation to limit header size and recipient list length. Temporarily disable DKIM signing if CPU exhaustion is observed.

Hi! I’m here to help you understand CVE-2026-110871. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70