Nodemailer CVE-2026-110872

Exploitation requires the vulnerable Nodemailer client to establish an SMTP connection to a server under attacker control, or the attacker to be on-path on an existing SMTP connection - the malicious continuation-line stream is delivered by the SMTP peer, not by an arbitrary remote client, and triggers before authentication completes. This is reflected in the CVSS AC:H and AT:P metrics. Limiting factors: the application must be configured to connect to an untrusted or attacker-influenceable SMTP server, or the network path must be compromised (e.g., no TLS, or TLS stripping/MITM); applications that only ever connect to a fixed, trusted, TLS-protected SMTP relay have substantially reduced exposure. No authentication (PR:N) or user interaction (UI:N) is required once the malicious server/position is in place. Remediation is upgrading to Nodemailer 10.0.10 or later.

This is a genuine but conditional availability risk, not a blanket critical. The CVSS 4.0 base score of 8.2 is driven entirely by high availability impact (VA:H) with no confidentiality or integrity impact (VC:N/VI:N), reflecting a pure denial-of-service via quadratic-complexity parsing (CWE-400) that blocks the Node.js event loop and exhausts memory. Critically, the vector itself tempers the score: AC:H and AT:P indicate elevated attack complexity and a specific attack requirement - the victim client must connect to a malicious SMTP server, or an attacker must occupy an on-path position on the SMTP connection. PR:N/UI:N confirm no authentication or user interaction is needed once that positioning exists, and the flaw triggers pre-authentication. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or weaponization. The practical priority is therefore moderate: the impact is real and the fix is clear, but exploitation presupposes either a compromised/attacker-run mail server the application trusts or network interposition, which meaningfully narrows the realistic attacker population compared to a typical AV:N/AC:L internet-facing flaw.

An application using a vulnerable Nodemailer version is induced to connect to a mail server the attacker controls (or the attacker is on-path on the SMTP link). The server streams continuation reply lines indefinitely without sending a completion line before authentication; the quadratic parsing in SMTPConnection._onData/isPartialResponse pegs CPU and grows memory, freezing the Node.js event loop and taking the service down. No public exploit code is identified at time of analysis.