{"id":"EUVD-2026-101752","revision":"286bd59da35a4107b93b68d4b075c7db","records":[{"revision":"286bd59da35a4107b93b68d4b075c7db","observedAt":"2026-10-30T01:56:04.772+00:00","statement":{"source":"euvd","id":"EUVD-2026-101752","aliases":["CVE-2026-110869","GHSA-mgrc-5q39-2h34"],"title":"Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or m…","description":"Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or man-in-the-middle SMTP server can reply to EHLO with 250-AUTH, a long whitespace run and a non-matching token, blocking the Node.js event loop for tens of seconds to hours before authentication.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":8.7,"severity":null}],"references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-4ffr-jq9g-5ffx","https://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.0.13-redos-via-smtp-auth-mechanism-detection-regexes"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101752","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 14, 2026, 10:52:57 PM","dateUpdated":"Oct 15, 2026, 3:35:29 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-101752","identifiers":["EUVD-2026-101752","CVE-2026-110869","GHSA-mgrc-5q39-2h34"]},"retained":false,"historicalAffected":[]}],"coverage":[]}