CVE-2026-110869

Executive Summary

CVE-2026-110869 is a regular expression denial of service (ReDoS) vulnerability in Nodemailer versions 3.0.0 through 10.0.12. The flaw resides in the SMTPConnection._actionEHLO function, where four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that cause quadratic backtracking when processing a malicious EHLO response from an SMTP server. A remote attacker or man-in-the-middle positioned between the Nodemailer client and the SMTP server can send a crafted 250-AUTH response containing a long whitespace run followed by a non-matching token, blocking the Node.js event loop for tens of seconds to hours and causing a denial of service.

Technical Analysis

The vulnerability is classified as CWE-1333 (Inefficient Regular Expression Complexity). Nodemailer's SMTP client, when establishing a connection, sends the EHLO command to the SMTP server and processes the multiline response. The _actionEHLO handler parses the server's capabilities, including the list of supported AUTH mechanisms (e.g., PLAIN, LOGIN, CRAM-MD5). To extract these mechanisms, the code uses four regular expressions that each attempt to match AUTH-related lines. These regexes contain overlapping whitespace matching constructs — for example, patterns that allow a run of whitespace to be matched by multiple adjacent quantifiers or sub-patterns. When the input contains a long sequence of spaces or tabs followed by a token that does not match the expected mechanism pattern, the regex engine attempts an exponential number of backtracking paths. Because the regexes are employed within the Node.js event loop, the synchronous execution blocks all other I/O operations. The attack is triggered entirely by the SMTP server's response to the EHLO command; no authentication is required, and the client need not be authenticated. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates a network-reachable, low-complexity, unauthenticated attack that causes a high availability impact with no confidentiality or integrity impact.

Exploitation Scenarios

1. Reconnaissance / Target Identification: An attacker identifies a target application that uses Nodemailer to send email via an SMTP server. This could be any Node.js application (e.g., a web application's password reset functionality, notification system, or transactional email service) that connects to an external or internal SMTP server. The attacker may be an external adversary who can influence the SMTP server's responses (e.g., by compromising or spoofing the configured SMTP server, or by operating a malicious SMTP server that the application connects to). Alternatively, a man-in-the-middle attacker positioned on the network path between the Nodemailer client and the legitimate SMTP server can intercept and modify the EHLO response.

2. Triggering the Flaw: The attacker sends an EHLO response that includes a line beginning with 250-AUTH, followed by a long run of whitespace characters (spaces or tabs) and then a token that does not match any valid AUTH mechanism string. The exact required length of the whitespace run depends on the regex engine's backtracking characteristics but can be in the range of thousands to tens of thousands of characters. The four vulnerable regexes in SMTPConnection._actionEHLO will attempt to match this line, and due to overlapping whitespace sub-patterns, the regex engine will explore a quadratic number of backtracking steps. This causes the Node.js event loop to be blocked for an extended period — potentially tens of seconds or even hours if the input is large enough.

3. Payload / Execution Method: The attack is delivered as part of the SMTP protocol response. The attacker does not need to send a separate payload; the malicious EHLO response itself is the payload. For a man-in-the-middle scenario, the attacker modifies the server's response in transit. For a malicious server scenario, the attacker configures the server to return the crafted response. No special tools are required beyond the ability to control or intercept SMTP traffic.

4. Post-Exploitation Impact: The blocking of the event loop renders the Node.js application unresponsive. All pending and incoming requests queued in the event loop are delayed, causing a denial of service for the application's users. If the application is a critical service (e.g., authentication, payment processing), this can lead to business disruption, failed transactions, and potential cascading failures in dependent systems. The attack can be repeated to sustain the denial of service.

Impact Assessment

Successful exploitation results in a high availability impact, as indicated by the CVSS score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The vulnerability affects any application using Nodemailer versions 3.0.0 through 10.0.12 to communicate with an SMTP server over which an attacker has influence. This includes applications that connect to external SMTP relays, as well as those using internal SMTP servers if an attacker can intercept traffic. The blast radius can be significant: a single malicious response can block the event loop of the entire Node.js process, affecting all functionality served by that process. Because the attack requires no authentication and low complexity, it is attractive to denial-of-service actors. However, no exploitation in the wild, public PoC, or malware usage has been observed at the time of writing.

Detection Guidance

Sigma Rule

title: Nodemailer ReDoS via Malicious EHLO Response
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects SMTP server responses containing a long whitespace run after 250-AUTH, indicative of CVE-2026-110869 exploitation.
author: Threat Intelligence Team
date: 2025-04-09
logsource:
  product: smtp
  service: smtp_server
detection:
  selection:
    response_code: 250
    response_text|contains: '250-AUTH'
    response_text|re: '250-AUTH\s{1000,}'
  condition: selection
falsepositives:
  - Legitimate mail servers with unusual formatting
level: high

YARA Rule

rule CVE_2026_110869_Nodemailer_ReDoS
{
    meta:
        description = "Detects SMTP EHLO responses with long whitespace runs after 250-AUTH"
        author = "Threat Intelligence Team"
        date = "2025-04-09"
        reference = "CVE-2026-110869"
        severity = "high"
    strings:
        $auth = "250-AUTH"
        $ws = /[ \t]{1000,}/
    condition:
        $auth and $ws
}

Suricata IDS Rule

alert tcp any 25 -> any any (msg:"CVE-2026-110869 Nodemailer ReDoS Attempt"; flow:to_client,established; content:"250-AUTH"; nocase; pcre:"/250-AUTH[ \t]{1000,}/"; classtype:attempted-dos; sid:1000001; rev:1;)

Elastic Detection

sequence by process.entity_id
  [network where network.protocol == "smtp" and smtp.response == "250-AUTH"]
  [process where process.name == "node" and event.action == "event_loop_blocked"]

Splunk SPL Query

index=network sourcetype=smtp
| search "250-AUTH"
| regex _raw="250-AUTH\s{1000,}"
| stats count by src_ip, dest_ip, dest_port
| where count > 0

Wazuh OSSEC Rule

<rule id="100001" level="12">
  <decoded_as>smtp</decoded_as>
  <match>250-AUTH</match>
  <regex>250-AUTH\s{1000,}</regex>
  <description>CVE-2026-110869: Nodemailer ReDoS attempt via SMTP EHLO</description>
  <mitre>
    <id>T1499</id>
  </mitre>
</rule>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Restrict outbound SMTP connections to trusted, known-good SMTP servers using firewall rules or egress filtering.
   • Enforce TLS/SSL for SMTP connections to prevent man-in-the-middle tampering with EHLO responses.
   • Implement monitoring for long-running event loop blocks or excessive CPU usage on Node.js processes.
   • If possible, isolate Nodemailer usage into a separate worker process or service so that blocking does not affect the main application.
   • As a temporary workaround, if the SMTP server's AUTH capabilities are not needed (e.g., using no authentication or pre-configured credentials), disable the parsing of AUTH mechanisms if the library allows it, or use a custom SMTP client.

2. Patch/Upgrade Steps:

   • No official patch is available. Monitor the Nodemailer GitHub repository and NVD for updates.
   • Once a patched version is released, upgrade to the fixed version (likely >10.0.12) immediately.
   • For environments where upgrade is not immediately possible, consider replacing Nodemailer with an alternative SMTP library that is not affected, after thorough testing.

3. Long-Term Hardening:

   • Adopt a dependency scanning tool to detect vulnerable versions of Nodemailer and other libraries.
   • Implement regular expression analysis tools (e.g., safe-regex) in development processes to avoid similar ReDoS issues.
   • Conduct code reviews for regex patterns that may have super-linear backtracking.
   • Apply the principle of least privilege to network egress to reduce attack surface.

References

1. NVD – CVE-2026-110869: https://nvd.nist.gov/vuln/detail/CVE-2026-110869
2. Nodemailer GitHub Repository: https://github.com/nodemailer/nodemailer
3. CWE-1333: Inefficient Regular Expression Complexity: https://cwe.mitre.org/data/definitions/1333.html
4. OWASP Regular Expression Denial of Service: https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS
5. No known threat actor campaigns or exploit-in-the-wild evidence at this time.