CVE-2026-110871 in Nodemailer
Summary
by MITRE • 10/15/2026
Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers that fold into tens of thousands of continuation lines, blocking the Node.js event loop during DKIM signing.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The Nodemailer library, a widely used JavaScript module for sending emails via SMTP and other transport methods, contains a significant denial of service vulnerability in its MessageParser component. Specifically, the parseHeaders function exhibits quadratic time complexity when processing header unfolding operations. This flaw allows an attacker to craft malicious email messages with excessively large recipient lists or headers that are heavily folded into thousands of continuation lines. When such malformed input is processed by Nodemailer versions ranging from 3.0.0 up to but not including 10.0.10, the parser enters a computationally expensive loop that scales poorly relative to the size and complexity of the header data. The quadratic nature of this algorithm means that as the number of folded lines increases, the processing time grows exponentially rather than linearly, leading to severe performance degradation.
The operational impact of this vulnerability is primarily centered around resource exhaustion on the server hosting the Nodemailer instance. Because Node.js operates on a single-threaded event loop model, any long-running or computationally intensive task can block the execution of other asynchronous operations. In this specific case, the excessive CPU consumption caused by parsing these malformed headers effectively blocks the event loop. This blocking effect is particularly critical during DKIM signing processes, which are often triggered when sending emails with cryptographic signatures to ensure message integrity and authenticity. When the event loop is blocked by the quadratic header unfolding attack, legitimate email delivery operations stall, resulting in a denial of service for other users or services relying on the same Nodemailer instance. This can lead to significant downtime, missed communications, and potential cascading failures in systems that depend on timely email notifications.
From a security classification perspective, this vulnerability aligns with CWE-400, which describes uncontrolled resource consumption leading to denial of service. The attack vector involves the manipulation of input data (email headers) to trigger inefficient algorithmic behavior within the application logic. In terms of adversary tactics and techniques, this scenario maps to ATT&CK technique T1496, Resource Hijacking, where an attacker uses computing resources for their own benefit or to disrupt service availability. It also relates to T1055, Process Injection, in a broader sense if the CPU exhaustion leads to system instability that could be exploited further, though the primary impact here is straightforward denial of service through computational overload. The vulnerability highlights the importance of validating and limiting input size, particularly for text-based protocols like SMTP where header folding is a standard but potentially abuse-prone feature.
To mitigate this risk, organizations using affected versions of Nodemailer should immediately upgrade to version 10.0.10 or later, which includes patches addressing the quadratic complexity in the MessageParser.parseHeaders function. For environments that cannot be updated instantly, implementing input validation at the application layer is recommended. This involves setting strict limits on the maximum length of email headers and the number of recipients before they are passed to Nodemailer for processing. Additionally, deploying rate limiting or request throttling mechanisms can help prevent a single malicious actor from overwhelming the server with multiple large payloads. Monitoring CPU usage patterns associated with email sending operations can also aid in early detection of such abuse attempts, allowing administrators to intervene before significant service disruption occurs. Regularly updating dependencies and conducting code reviews for potential algorithmic inefficiencies are essential practices for maintaining robust application security posture against denial of service attacks.