{"id":"EUVD-2026-101752","enisaUuid":"27418023-70ca-31c4-87c2-3bc81fcae815","description":"Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or man-in-the-middle SMTP server can reply to EHLO with 250-AUTH, a long whitespace run and a non-matching token, blocking the Node.js event loop for tens of seconds to hours before authentication.","datePublished":"Oct 14, 2026, 10:52:57 PM","dateUpdated":"Oct 15, 2026, 3:35:29 PM","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-4ffr-jq9g-5ffx\nhttps://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.0.13-redos-via-smtp-auth-mechanism-detection-regexes\n","aliases":"CVE-2026-110869\nGHSA-mgrc-5q39-2h34\n","assigner":"VulnCheck","epss":0.37,"enisaIdProduct":[{"id":"374bd105-f794-3995-ba5c-d888f26e9cc6","product":{"name":"nodemailer","vendor":{"name":"nodemailer"}},"product_version":"3.0.0 \u003c10.0.13"}],"enisaIdVendor":[{"id":"5fb9c069-9785-355d-ba72-6cb32ffb5fcd","vendor":{"name":"nodemailer"}}],"enisaIdVulnerability":[{"id":"2a58cc4b-356d-3421-b2fd-744db398d4ca","vulnerability":{"id":"GHSA-mgrc-5q39-2h34","description":"Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or man-in-the-middle SMTP server can reply to EHLO with 250-AUTH, a long whitespace run and a non-matching token, blocking the Node.js event loop for tens of seconds to hours before authentication.","datePublished":"Oct 15, 2026, 12:31:19 AM","dateUpdated":"Oct 15, 2026, 12:31:19 AM","baseScore":0.0,"references":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-4ffr-jq9g-5ffx\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-110869\nhttps://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.0.13-redos-via-smtp-auth-mechanism-detection-regexes\n","enisa_id":"EUVD-2026-101752\n","aliases":"GHSA-mgrc-5q39-2h34\nCVE-2026-110869\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:03:05 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"5530c21a-cadf-3c8f-8244-74b56970195c","vulnerability":{"id":"CVE-2026-110869","description":"Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or man-in-the-middle SMTP server can reply to EHLO with 250-AUTH, a long whitespace run and a non-matching token, blocking the Node.js event loop for tens of seconds to hours before authentication.","datePublished":"Oct 14, 2026, 10:52:57 PM","dateUpdated":"Oct 15, 2026, 3:35:29 PM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-4ffr-jq9g-5ffx\nhttps://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.0.13-redos-via-smtp-auth-mechanism-detection-regexes\n","enisa_id":"EUVD-2026-101752\n","assigner":"VulnCheck","epss":0.37,"dataProcessed":"Oct 27, 2026, 7:14:16 AM","vulnerabilityProduct":[{"id":"370b1ed5-03e0-3cf1-ac1c-aac503a723b7","product":{"name":"nodemailer","vendor":{"name":"nodemailer"}},"product_version":"3.0.0 \u003c10.0.13"}],"vulnerabilityVendor":[{"id":"0894f17b-c110-307c-827e-b0b99adfc544","vendor":{"name":"nodemailer"}}]}}],"enisaIdAdvisory":[]}