CVE-2026-110871

MediumCVSS 6.5/10Last modified Oct 20, 2026

Description

Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers that fold into tens of thousands of continuation lines, blocking the Node.js event loop during DKIM signing.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
nodemailer	nodemailer	>= 3.0.0, < 10.0.10

References

Timeline

Published: Oct 14, 2026
Last modified: Oct 20, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1108725.9Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTP CVE-2026-1108737.1Heym from 0.0.55 before 0.0.121 contains a privilege escalation vulnerability that allows shared collaborators to overwrite a workflow's err CVE-2026-1108746.6Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize() in functions.lib.php, which calls unserialize() CVE-2026-1108756.1AdPlug through 2.4 contains a heap-based buffer overflow in CksmPlayer::update() in src/ksm.cpp that writes past the fixed databuf[2048] arr CVE-2026-1108765.5AdPlug through 2.4 contains an out-of-bounds read vulnerability in src/xsm.cpp that allows attackers to read before note_table by supplying CVE-2026-1108775.5AdPlug through 2.4 contains a heap out-of-bounds read vulnerability in CdmoLoader::load() in src/dmo.cpp that allows attackers to read past CVE-2026-1108785.4Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts via unescape CVE-2026-1108799.8jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even CVE-2026-110889.6Integer overflow in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to pote CVE-2026-1108806.5Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Secu CVE-2026-1108816.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureDash suredash all CVE-2026-1108824.3Missing Authorization vulnerability in Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications sms-alert allows Exploiting Incorrec