Nodemailer EUVD-2026-101752

Exploitation requires that the vulnerable Nodemailer client (3.0.0 up to but not including 10.0.13) initiate an SMTP connection to a server the attacker controls, OR that the attacker occupy a man-in-the-middle position on the SMTP connection (realistic on plaintext/unencrypted SMTP or where TLS is not enforced). The trigger is specifically a server EHLO response of the form '250-AUTH' followed by a long whitespace run and a non-matching token, which drives quadratic backtracking in the four AUTH-mechanism detection regexes in SMTPConnection._actionEHLO. Limiting factors: the attacker cannot reach this code path unless the victim application connects outbound to an attacker-influenced or MITM-able SMTP endpoint, so deployments that only use fixed, trusted, TLS-authenticated mail servers are substantially harder to exploit; impact is confined to event-loop blocking / denial of service with no data exposure.

This is a genuine but bounded availability risk, not a top-tier emergency. The CVSS 4.0 base score of 8.7 is driven entirely by VA:H (high availability impact) with VC:N/VI:N - there is no confidentiality or integrity exposure, so this is a pure denial-of-service (CWE-1333 ReDoS). The vector reports AV:N/AC:L/PR:N/UI:N, which looks like trivial remote unauthenticated exploitation, but that scoring obscures a critical real-world precondition: the vulnerable code path is the SMTP *client*, so an attacker must either operate the SMTP server the Node.js application connects to or hold a man-in-the-middle position on that connection. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical signal set is therefore: high nominal CVSS, but exploitation gated on adversary control of the mail server or transport path, and a blast radius limited to event-loop blocking (service hang) rather than compromise. Treat as a prompt-patch dependency hygiene item rather than a drop-everything incident, with elevated priority for applications that connect to untrusted, user-configurable, or unauthenticated SMTP endpoints.

An application using a vulnerable Nodemailer version connects to an SMTP server controlled by the attacker (for example a user-supplied relay) or one reachable via a man-in-the-middle on an unencrypted link. During the EHLO handshake the malicious server replies with a 250-AUTH line containing a long whitespace run followed by a non-matching token, triggering quadratic regex backtracking that blocks the Node.js event loop for seconds to hours. No public exploit was identified at time of analysis, but the trigger is a single crafted server response and requires no authentication against the victim.