CVE-2026-110871

Executive Summary

CVE-2026-110871 is a denial of service vulnerability in Nodemailer versions 3.0.0 through before 10.0.10, affecting the MessageParser.parseHeaders routine. An attacker able to supply crafted headers or large recipient lists can force quadratic header unfolding, exhausting CPU and blocking the Node.js event loop, which stalls DKIM signing and any other mail processing activity in the same process. CVSS v3.1 score is 6.5 (Medium), reflecting high availability impact with low privileges required over a network vector.

Technical Analysis

The vulnerability resides in Nodemailer's MessageParser.parseHeaders function, which processes RFC 5322-style message headers, including folded headers where a logical header value continues across multiple physical lines (continuation lines). The NVD description states that Nodemailer "from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding."

Two conditions are described as triggers:

1. Large recipient lists — many To, Cc, or Bcc entries that expand header processing work.
2. Long headers that fold into tens of thousands of continuation lines — each fold line requires concatenation/unfolding work, and the processing cost scales quadratically (O(n²)) with the number of continuation lines rather than linearly.

Because header unfolding is performed synchronously on the Node.js event loop, excessive CPU consumption in MessageParser.parseHeaders blocks the entire event loop for the duration of processing. The NVD description specifically notes that this "block[s] the Node.js event loop during DKIM signing," meaning applications that parse untrusted message headers and then sign them with DKIM are especially exposed. While parsing is stalled, no other callbacks, timers, or I/O events for that Node.js process can be serviced — the process effectively stops responding.

This is a classic algorithmic complexity / resource consumption flaw (CWE-400, Uncontrolled Resource Consumption). No exploitation has been observed publicly; no PoC, Nuclei template, or exploit code is tracked. The attack is inferable purely from the vulnerability class and the described mechanism, and requires no authentication bypass — only the ability to cause attacker-controlled headers to reach MessageParser.parseHeaders (or to submit large recipient lists through an exposed mail-processing endpoint that uses the library).

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H indicates:

• AV:N — reachable over the network.
• AC:L — no special conditions required.
• PR:L — attacker needs some low-level permission/access (e.g., ability to submit mail or interact with the mail-processing path).
• UI:N — no user interaction.
• S:U — impact confined to the vulnerable component.
• C:N/I:N/A:H — no confidentiality or integrity impact; high availability impact.

Exploitation Scenarios

No public PoC available; attack chain is inferred from vulnerability class. The following steps describe exploitation at the vulnerability-class level and rely only on details present in the NVD description.

1. Reconnaissance / target identification. The attacker identifies an application or service that uses Nodemailer in an affected version (3.0.0 to before 10.0.10) and that processes attacker-influenced message headers or recipient lists. Candidate surfaces include public web forms that compose or relay email, mail-ingestion endpoints, and any API that accepts a message and then parses/signs it with DKIM.

2. Triggering the flaw class. The attacker supplies input that reaches MessageParser.parseHeaders. Per the description, this is done either with a large recipient list or with long headers containing tens of thousands of folded continuation lines. The folded-header format is legitimate per RFC 5322, so malformed-looking but structurally valid messages are sufficient — the attacker is not exploiting a parsing bug that rejects bad input, but abusing the cost of correct unfolding.

3. Payload / execution method. Because the CPU cost of unfolding scales quadratically (O(n²)), a single message with a sufficiently large number of continuation lines can consume disproportionate CPU time. Delivering a small number of such messages, or repeatedly delivering them, occupies the Node.js event loop. No code execution, memory corruption, or file write is involved — the "payload" is simply header structure and volume.

4. Post-exploitation impact. The event loop block stalls all asynchronous work in the process, including DKIM signing as explicitly called out in the description. The service becomes unresponsive (denial of service). Impact is bounded to availability — there is no confidentiality or integrity impact per the CVSS vector — and the effect is not persistent beyond the processing of the offending message(s).

Impact Assessment

Business impact centers on availability: any Node.js service that parses untrusted message headers via Nodemailer and then performs synchronous work (notably DKIM signing) can be stalled. Because the Node.js event loop is single-threaded, one expensive parse can starve all other requests served by the same process, potentially creating an application-wide outage rather than degradation of a single request. Blast radius scales with deployment topology: a single-process email relay may be fully taken down; a horizontally scaled deployment may experience intermittent latency spikes or partial unavailability as instances are successively blocked.

CVSS subscores reinforce the risk profile: high availability impact (A:H), low attack complexity (AC:L), no user interaction (UI:N), and no confidentiality or integrity impact (C:N/I:N). The overall score sits at 6.5 (Medium) because the Privileges Required value is Low (PR:L) — the attacker must already be able to reach a mail-processing path. There is no CISA KEV listing, no observed exploitation in the wild, and no EPSS score available at time of writing.

Detection Guidance

Detection should focus on anomalous header structures (very high continuation-line counts, unusually large recipient lists) arriving at mail-processing endpoints and on event-loop starvation symptoms (event loop lag, DKIM signing timeouts, request queue growth).

Sigma Rule

title: Nodemailer Quadratic Header Unfolding DoS Attempt (CVE-2026-110871)
id: 6f4c2b9e-1a7d-4c33-9b2e-7d5a0e9c1108
status: experimental
description: Detects messages with abnormally high folded header continuation line counts or oversized recipient lists that may trigger quadratic header unfolding in nodemailer MessageParser.parseHeaders.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-110871
author: valtersit.com
date: 2026/01/01
logsource:
  category: application
  product: mail
detection:
  selection_msg:
    message|contains:
      - 'nodemailer'
      - 'MessageParser'
  selection_fields:
    header_continuation_lines|gte: 1000
    recipient_count|gte: 500
  condition: selection_msg and selection_fields
falsepositives:
  - Legitimate bulk mail with very large distribution lists
  - Mailing list software generating extensive headers
level: medium
tags:
  - attack.t1499
  - cve.2026.110871

YARA Rule

rule CVE_2026_110871_Nodemailer_Header_Unfolding_DoS
{
    meta:
        author = "valtersit.com"
        description = "Detects message artifacts with excessive folded header continuation lines consistent with CVE-2026-110871"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-110871"
        date = "2026-01-01"

    strings:
        $hdr1 = "To:" nocase
        $hdr2 = "Cc:" nocase
        $hdr3 = "Bcc:" nocase
        $fold = "\r\n\t"
        $foldsp = "\r\n "

    condition:
        filesize < 5MB and
        ($hdr1 or $hdr2 or $hdr3) and
        (#fold + #foldsp) > 1000
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-110871 Nodemailer Quadratic Header Unfolding DoS Attempt - Excessive Folded Headers"; flow:established,to_server; content:"To:"; nocase; http_client_body; pcre:"/(\r\n[ \t]){500,}/"; threshold:type both, track by_src, count 1, seconds 60; classtype:attempted-dos; reference:cve,2026-110871; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-110871; sid:2026110871; rev:1;)

Elastic Detection

sequence by host.id with maxspan=1m
  [process where event.action == "start" and process.name : ("node", "node.exe")]
  [network where event.action == "connection_accepted" and process.name : ("node", "node.exe")]

Splunk SPL Query

index=mail OR index=app
| search ("nodemailer" OR "MessageParser" OR "parseHeaders" OR "DKIM")
| eval cont_lines = mvcount(split(_raw, "\r\n "))
| where cont_lines >= 500 OR recipient_count >= 500
| stats count min(_time) as first_seen max(_time) as last_seen by host, src_ip
| where count >= 1
| sort - cont_lines
| table host src_ip count first_seen last_seen

Wazuh OSSEC Rule

<group name="nodemailer,appsec,">
  <rule id="110871" level="8">
    <decoded_as>json</decoded_as>
    <field name="event">nodemailer_parse</field>
    <description>CVE-2026-110871: Possible Nodemailer header unfolding DoS - high continuation line or recipient volume detected</description>
    <options>no_full_log</options>
    <group>dos,</group>
  </rule>

  <rule id="110872" level="10">
    <if_sid>110871</if_sid>
    <field name="continuation_lines">^[0-9]{4,}$</field>
    <description>CVE-2026-110871: Extreme folded header continuation count observed in MessageParser.parseHeaders</description>
    <group>dos,critical,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Enforce input limits at the application boundary before data reaches Nodemailer: cap the number of folded continuation lines accepted per header, cap total header byte size, and cap recipient list length (e.g., reject messages with oversized To/Cc/Bcc lists).
   • Where DKIM signing is performed, move it off the main event loop (worker threads or a separate process) so a blocking parse cannot stall critical request handling.
   • Apply reverse-proxy or middleware request-size limits to endpoints that accept message content.
   • Instrument event-loop lag monitoring to detect starvation early.

2. Patch / upgrade steps

   • No vendor patch has been confirmed by tracked sources. The NVD description references affected versions "from 3.0.0 before 10.0.10," implying 10.0.10 is the version that resolves the issue. Verify the fix directly against the upstream project's release notes and changelog before relying on it.
   • Plan an upgrade path to a maintained Nodemailer release once confirmed, and validate MessageParser.parseHeaders behavior with folded-header test cases in a staging environment.

3. Long-term hardening

   • Treat all inbound headers and recipient lists as untrusted input and enforce structural complexity limits (line counts, fold depth) uniformly across all mail-parsing code paths.
   • Avoid synchronous, unbounded processing of attacker-controlled data on the Node.js event loop; adopt worker-based parsing for message normalization and signing.
   • Maintain a software bill of materials for Node.js dependencies and monitor security advisories for Nodemailer and related mail libraries.
   • Add regression tests that include pathological folded-header inputs to catch reintroductions of quadratic behavior.

References

• NVD — CVE-2026-110871: https://nvd.nist.gov/vuln/detail/CVE-2026-110871
• CWE-400: Uncontrolled Resource Consumption — https://cwe.mitre.org/data/definitions/400.html
• MITRE ATT&CK T1499 (Endpoint Denial of Service) — https://attack.mitre.org/techniques/T1499/
• FIRST EPSS (no score currently published for this CVE) — https://www.first.org/epss/
• Nodemailer project repository and release notes (verify fix in 10.0.10 upstream) — https://github.com/nodemailer/nodemailer

No known threat actor campaigns or exploit-in-the-wild evidence have been observed for CVE-2026-110871.