CVE-2026-110871 · GHSA-39m8-27wv-hr27
Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing
- Risk score
- 52/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 14 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers that fold into tens of thousands of continuation lines, blocking the Node.js even…
- Affected
- nodemailer (npm) >= 3.0.0, <= 10.0.9
- Fix
- Upgrade nodemailer to 10.0.10 or later.
- Exploitation
- Public proof of concept
Why it is Yellow
- CVSS 6.5 medium
- Public exploit or proof of concept referenced
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| nodemailer | npm | >= 3.0.0, <= 10.0.9 | 10.0.10 |
References
- https://github.com/advisories/GHSA-39m8-27wv-hr27
- https://github.com/nodemailer/nodemailer/security/advisories/GHSA-39m8-27wv-hr27
- https://nvd.nist.gov/vuln/detail/CVE-2026-110871
- https://github.com/nodemailer/nodemailer/commit/28a5909cec27646cb001dc7e97a8f5d26c973078
- https://github.com/nodemailer/nodemailer/releases/tag/v10.0.10
- https://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.0.10-quadratic-dkim-header-unfolding-denial-of-service
- https://github.com/advisories/GHSA-39m8-27wv-hr27
Original description
Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers that fold into tens of thousands of continuation lines, blocking the Node.js event loop during DKIM signing.
Last activity 14 Oct 2026. Patch Forecast updates every hour.