Nodemailer CVE-2026-110871

Exploitation requires that the attacker can influence the content passed to Nodemailer's message builder - specifically the recipient list (to/cc/bcc) or header fields - so that headers fold into tens of thousands of continuation lines, and that DKIM signing is active, since the quadratic unfolding is triggered in MessageParser.parseHeaders on the signing path. Limiting factors: the CVSS vector's PR:L means at least low-level authenticated/application access to the send functionality is needed (not anonymous internet access), and the impact is availability-only (no data exposure or code execution). Realistic risk is highest in services that accept user-controlled recipients or headers and run DKIM signing in the same Node.js process serving other requests, because the single-threaded event loop stalls process-wide. Affected only when running Nodemailer 3.0.0 up to but not including 10.0.10.

This is a moderate-severity availability-only flaw (CWE-400 uncontrolled resource consumption) whose signals are internally consistent rather than conflicting. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with VA:H and both VC:N and VI:N correctly reflects a pure denial-of-service with no confidentiality or integrity impact, scored 7.1. The AV:N/AC:L combination makes triggering mechanically easy once an attacker can submit message content, but PR:L indicates the attacker needs at least low-level privileges - typically the ability to call the application's mail-send path or control recipient/header input - so this is not an unauthenticated internet-facing bug. No EPSS score, CISA KEV listing, or public exploit was supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation; absence of these is not itself a mitigating guarantee but argues against widespread opportunistic attacks. Net assessment: a credible availability risk worth patching promptly in multi-tenant or user-input-driven mail services where attackers can influence recipient lists or headers, but lower priority than an RCE or an unauthenticated network DoS. The quadratic blocking of the Node.js single-threaded event loop is the key amplifier - one malicious message can stall the entire process, not just one request.

An attacker with the ability to submit email content to an application that uses Nodemailer (for example a low-privileged user of a notification or contact feature) supplies a message with a very large recipient list or an extremely long header that unfolds into tens of thousands of continuation lines. During DKIM signing, MessageParser.parseHeaders performs quadratic-time header unfolding, pinning a CPU core and blocking the Node.js event loop so the entire service stops responding. No public proof-of-concept is referenced, but the low attack complexity (AC:L) makes crafting such input straightforward.