CVE-2026-110872 nodemailer CVE debrief

Who should care

Defenders responsible for Node.js applications using Nodemailer, especially those accessing untrusted SMTP servers, should assess exposure and prioritize updates. This includes operators managing affected systems, platform administrators, vulnerability management teams, and security teams responsible for monitoring and incident response. They should verify Nodemailer versions, restrict access to untrusted SMTP servers, and monitor for unusual behavior in N

Why it matters

CVE-2026-110872 is a high-severity denial-of-service vulnerability in Nodemailer that can be exploited by malicious SMTP servers or on-path attackers. Defenders should verify and update Nodemailer, restrict access to untrusted SMTP servers, and monitor Node.js applications for unusual behavior.

• Potential denial-of-service due to event loop blocking
• Memory exhaustion in Node.js applications
• Need for verification of Nodemailer version and exposure
• Possible impact on application availability and performance

Technical summary

The vulnerability is caused by a quadratic complexity issue in the SMTP client reply parser of Nodemailer. This can be exploited by an attacker to block the Node.js event loop and exhaust memory, leading to a denial-of-service condition. The issue affects Nodemailer versions from 3.0.0 before 10.0.10. The vulnerability can be triggered by streaming continuation lines without a completion line before authentication, potentially impacting Node.js applications that use Nodemailer to access untrusted SMTP servers. Defenders should assess exposure and prioritize updates.

Defensive priority

Defenders should prioritize verifying and updating Nodemailer to version 10.0.10 or later, especially in environments where untrusted SMTP servers are accessed.

Recommended defensive actions

• Verify Nodemailer version and update to 10.0.10 or later
• Review and restrict access to untrusted SMTP servers
• Monitor for unusual Node.js event loop behavior and memory usage
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE Program and NVD provide official records of this vulnerability. Vendor advisories and third-party analyses also detail the issue. Defenders should verify Nodemailer versions, review exposure, and monitor for unusual behavior. Evidence is limited to public sources and CVE records. No additional information is available beyond official advisories and CVE details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.