{"id":"EUVD-2026-101755","enisaUuid":"6bff270a-24f6-380b-a3f3-f94af9b246fa","description":"Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection._onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before authentication, blocking the Node.js event loop and exhausting memory.","datePublished":"Oct 14, 2026, 10:53:00 PM","dateUpdated":"Oct 15, 2026, 1:30:56 PM","baseScore":8.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-4g23-2xm8-66gc\nhttps://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.0.10-denial-of-service-via-smtp-reply-parsing\n","aliases":"CVE-2026-110872\nGHSA-37fc-hcrp-mmff\n","assigner":"VulnCheck","epss":0.36,"enisaIdProduct":[{"id":"7c200423-5b2d-3729-a6a2-83b77a429da3","product":{"name":"nodemailer","vendor":{"name":"nodemailer"}},"product_version":"3.0.0 \u003c10.0.10"}],"enisaIdVendor":[{"id":"da72bae2-0908-3d82-a274-950fd1411d1d","vendor":{"name":"nodemailer"}}],"enisaIdVulnerability":[{"id":"1b154497-0165-3b0e-bbc7-7ff44689fde4","vulnerability":{"id":"GHSA-37fc-hcrp-mmff","description":"Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection._onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before authentication, blocking the Node.js event loop and exhausting memory.","datePublished":"Oct 15, 2026, 12:31:19 AM","dateUpdated":"Oct 15, 2026, 12:31:19 AM","baseScore":0.0,"references":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-4g23-2xm8-66gc\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-110872\nhttps://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.0.10-denial-of-service-via-smtp-reply-parsing\n","enisa_id":"EUVD-2026-101755\n","aliases":"GHSA-37fc-hcrp-mmff\nCVE-2026-110872\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:03:05 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"96a6a52f-b85d-3bc7-8017-a67480954c06","vulnerability":{"id":"CVE-2026-110872","description":"Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection._onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before authentication, blocking the Node.js event loop and exhausting memory.","datePublished":"Oct 14, 2026, 10:53:00 PM","dateUpdated":"Oct 15, 2026, 1:30:56 PM","status":"PUBLISHED","baseScore":8.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-4g23-2xm8-66gc\nhttps://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.0.10-denial-of-service-via-smtp-reply-parsing\n","enisa_id":"EUVD-2026-101755\n","assigner":"VulnCheck","epss":0.36,"dataProcessed":"Oct 29, 2026, 7:13:43 AM","vulnerabilityProduct":[{"id":"3186ded7-6826-32d3-a0aa-7ca048cbd86e","product":{"name":"nodemailer","vendor":{"name":"nodemailer"}},"product_version":"3.0.0 \u003c10.0.10"}],"vulnerabilityVendor":[{"id":"e8670b03-9eea-35f9-b100-94181a7b0efe","vendor":{"name":"nodemailer"}}]}}],"enisaIdAdvisory":[]}