CVE-2026-110871

EUVD-2026-101754
Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers that fold into tens of thousands of continuation lines, blocking the Node.js event loop during DKIM signing.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 15.82%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
nodemailernodemailer
3.0.0 ≤
𝑥
< 10.0.10
CNA
Debian logo
Debian Releases
Debian Product
Codename
node-nodemailer
bookworm
vulnerable
forky
10.0.14+~8.0.2-1
fixed
sid
10.0.14+~8.0.2-1
fixed
trixie
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
node-nodemailer
focal
needs-triage
jammy
needs-triage
noble
needs-triage
resolute
needs-triage
Common Weakness Enumeration
References
https://github.com/nodemailer/nodemailer/security/advisories/GHSA-39m8-27wv-hr27
https://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.0.10-quadratic-dkim-header-unfolding-denial-of-service