CVE-2026-110872
MEDIUM
NVD
CVSS Score
5.9
Severity
MEDIUM
Published
Oct 14, 2026
Vendor
unknown
Description
Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection._onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before authentication, blocking the Node.js event loop and exhausting memory.