CVE-2026-110869 in Nodemailer
Summary
by MITRE • 10/15/2026
Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or man-in-the-middle SMTP server can reply to EHLO with 250-AUTH, a long whitespace run and a non-matching token, blocking the Node.js event loop for tens of seconds to hours before authentication.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in Nodemailer versions prior to 10.0.13 represents a significant regular expression denial of service (ReDoS) flaw located within the SMTPConnection._actionEHLO method. This component is responsible for parsing the server's response to an EHLO command, specifically focusing on identifying supported authentication mechanisms listed after the AUTH keyword. The core technical issue stems from four distinct regular expressions designed to detect these auth mechanisms, which contain overlapping whitespace sub-patterns. These patterns are structured in a way that creates catastrophic backtracking when processing input strings with long sequences of whitespace characters followed by tokens that do not match the expected format. When such malformed or maliciously crafted data is encountered, the regex engine enters an exponential time complexity loop as it attempts to find alternative ways to satisfy the overlapping constraints within the pattern.
From a technical perspective, this flaw exploits the inherent inefficiency of certain backtracking regular expression engines when faced with ambiguous patterns involving repeated whitespace characters like spaces, tabs, or newlines combined with non-matching trailing content. The quadratic nature of the backtracking means that as the length of the whitespace sequence increases, the time required to process it grows exponentially rather than linearly. This behavior effectively traps the Node.js event loop, which is single-threaded in its execution model for JavaScript code. Consequently, while the regex engine is stuck processing this pathological input, no other asynchronous operations can proceed, leading to a complete stall of the application's responsiveness and throughput capabilities during the authentication phase of an SMTP connection attempt.
The operational impact of this vulnerability allows a malicious actor or a man-in-the-middle attacker who controls or intercepts the SMTP server communication to cause a denial of service against the client running Nodemailer. By replying to the initial EHLO command with a 250-AUTH response containing an excessively long run of whitespace followed by a non-matching token, the attacker can block the event loop for tens of seconds up to several hours depending on the length and complexity of the crafted input. This results in resource exhaustion where the application becomes unresponsive, potentially leading to timeouts, dropped connections with legitimate users, or increased memory consumption as pending requests accumulate while waiting for the stuck process to eventually terminate or be killed by an external watchdog mechanism.
This vulnerability aligns with CWE-400, which classifies issues related to Uncontrolled Resource Consumption, specifically highlighting how inefficient algorithmic complexity in input validation can lead to system degradation. Furthermore, from a threat modeling perspective using the MITRE ATT&CK framework, this behavior corresponds to techniques associated with Denial of Service attacks where an adversary targets application availability through resource exhaustion rather than direct exploitation for data access or privilege escalation. The attack vector is classified as remote via network interaction during the SMTP handshake phase, requiring only that the attacker can influence the server's response string sent back to the client.
Mitigation strategies primarily involve upgrading Nodemailer to version 10.0.13 or later, where these regular expressions have been optimized and refactored to eliminate the overlapping whitespace sub-patterns responsible for the catastrophic backtracking. For environments unable to immediately upgrade, defensive coding practices such as implementing strict input length limits on SMTP responses before passing them to regex engines can provide a temporary layer of protection. Additionally, deploying network-level protections like Web Application Firewalls or intrusion detection systems that inspect SMTP traffic for anomalously long response strings during the EHLO exchange may help mitigate exposure by blocking malicious payloads before they reach the vulnerable application logic. Regular security audits focusing on regular expression complexity and performance testing against edge-case inputs are recommended to prevent similar vulnerabilities in future development cycles.