CVE-2026-110872

Executive Summary

CVE-2026-110872 is a quadratic complexity denial-of-service vulnerability in the Nodemailer SMTP client reply parser, affecting versions from 3.0.0 before 10.0.10. A malicious SMTP server or on-path attacker can stream continuation lines without ever sending a completion line, causing the parser to block the Node.js event loop and exhaust memory. Applications that send mail via Nodemailer to untrusted or attacker-influenceable SMTP endpoints are at risk of complete process unavailability.

Technical Analysis

The vulnerability resides in the SMTP client reply parser, specifically within SMTPConnection._onData and the isPartialResponse logic. SMTP is a line-oriented protocol: the server replies with status lines, and multi-line responses are indicated by a hyphen after the status code (e.g. 250-...), terminated by a line where a space follows the status code (e.g. 250 ...). The parser in Nodemailer accumulates incoming data and must determine whether the response is complete.

When a server streams continuation lines without ever emitting a terminal completion line, the parser's per-chunk processing cost grows with the total accumulated reply. This produces quadratic (O(n²)) time complexity relative to the number of buffered continuation lines: each new chunk triggers work that scales with the already-buffered content. Because Node.js runs application code on a single-threaded event loop, this unbounded work blocks the event loop, starving all other async operations in the process. Simultaneously, the never-terminating reply accumulates in memory, driving memory exhaustion.

The attack requires no authentication — it occurs during the SMTP reply phase before authentication completes. The precondition is that the application connects to an SMTP server the attacker controls or can position on-path (MITM) to relay to. Because the parser trusts the server's framing to signal completion, an adversarial or compromised server can hold the connection open indefinitely with continuation lines.

Root cause classification: CWE-400 (Uncontrolled Resource Consumption), realized as algorithmic complexity (quadratic parsing) plus unbounded buffering. CVSS 3.1 scores this 5.9 with AC:H reflecting the requirement for an adversarial/controlled SMTP peer, and A:H reflecting total loss of availability for the affected Node.js process. There are no confidentiality or integrity impacts (C:N/I:N/A:H).

No public proof-of-concept, exploit code, Nuclei template, or patch exists as of this writing. The patch confidence is 0/4 — no vendor fix has been published from any tracked source.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the NVD description. Function names used are those explicitly named in the description (SMTPConnection._onData, isPartialResponse).

1. Reconnaissance/target identification. The attacker identifies an application that uses Nodemailer in the affected version range (3.0.0 to <10.0.10) and that sends mail through an SMTP server the attacker controls or can intercept. This could be achieved by operating a public SMTP relay, compromising a third-party mail service, or positioning on-path between the application and its configured SMTP host.

2. Triggering the flaw. The attacker's SMTP server accepts the connection and, instead of returning a well-formed reply, begins streaming SMTP continuation lines (lines indicating a multi-line response is in progress) with no terminating completion line. The client's SMTPConnection._onData handler and isPartialResponse check continue to treat the reply as incomplete.

3. Payload/execution method (vulnerability-class level). No exploit payload is required beyond malformed protocol framing: the attacker simply withholds the terminal line and keeps sending continuation lines. Each chunk processed by _onData incurs parsing work that scales with total buffered data, and buffer growth is unbounded. The event loop is monopolized and heap usage climbs.

4. Post-exploitation impact. The Node.js process hosting the Nodemailer client becomes unresponsive and eventually exhausts memory, potentially crashing (OOM) or being killed by the runtime/container limits. Any service co-located in the same process (HTTP API, workers, schedulers) is denied service. This can be exploited opportunistically against any mail-sending application that trusts an attacker-reachable SMTP endpoint.

Impact Assessment

The impact is availability-only: affected Node.js processes suffer event loop starvation and memory exhaustion, degrading or halting all functionality hosted in that process. Confidentiality and integrity are unaffected (CVSS C:N/I:N/A:H), and no privileges are required (PR:N) and no user interaction is needed (UI:N). The attack is network-reachable (AV:N) but conditionally exploitable (AC:H) because the adversary must control or intercept the SMTP endpoint. Blast radius is proportional to process co-tenancy: single-purpose mail workers are limited to mail loss, while monolithic Node.js services may lose their entire request-serving capability. Because no authentication occurs before the vulnerable reply phase, pre-auth exposure to a malicious server is complete. No affected-version package mappings or vendor advisories are currently published.

Detection Guidance

Sigma Rule

title: Nodemailer SMTP Reply Parser DoS - Unbounded Continuation Lines
id: 8f3a1c2e-5b7d-4a91-9c0e-2d6f4b8a1e33
status: experimental
description: Detects Node.js/Nodemailer processes exhibiting event loop starvation or OOM correlated with outbound SMTP sessions that never receive a terminal reply line.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-110872
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1499
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith: '/node'
  selection_cmd:
    CommandLine|contains:
      - 'nodemailer'
      - 'smtp'
  condition: selection_img and selection_cmd
falsepositives:
  - Legitimate long-running mail queue workers
level: medium

YARA Rule

rule CVE_2026_110872_Nodemailer_Parser_DoS
{
    meta:
        description = "Detects Nodemailer module versions potentially affected by CVE-2026-110872 (SMTP reply parser quadratic DoS)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-110872"
        date = "2026-01-01"
        hash = "unknown"
    strings:
        $s1 = "SMTPConnection" ascii
        $s2 = "_onData" ascii
        $s3 = "isPartialResponse" ascii
        $s4 = "nodemailer" ascii nocase
        $ver = /"version"\s*:\s*"(3\.[0-9]+\.[0-9]+|[4-9]\.[0-9]+\.[0-9]+|10\.0\.[0-9])"/ ascii
    condition:
        uint32(0) == 0x04034b50 or filesize < 10MB
        and 3 of ($s1, $s2, $s3, $s4)
        and $ver
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"CVE-2026-110872 Nodemailer SMTP Reply Parser DoS - Excessive Continuation Lines"; flow:established,from_client; content:"|0d 0a|"; depth:0; byte_test:0,>,0,0; threshold:type both, track by_src, count 200, seconds 60; classtype:attempted-dos; reference:cve,2026-110872; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-110872; sid:2026110872; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=60s
  [ process where event.type == "start" and process.name : "node" ]
  [ network where destination.port in (25, 465, 587) and network.direction == "egress" ]

Splunk SPL Query

index=network OR index=endpoint sourcetype=suricata OR sourcetype=syslog
| search ("nodemailer" OR "SMTPConnection" OR destination_port=25 OR destination_port=587)
| stats count by src_ip, dest_ip, dest_port
| where count > 200
| sort - count

Wazuh OSSEC Rule

<group name="nodemailer,cve-2026-110872,">
  <rule id="110872" level="10">
    <decoded_as>json</decoded_as>
    <field name="process">node</field>
    <match>nodemailer|SMTPConnection|isPartialResponse|out of memory</match>
    <description>CVE-2026-110872: Possible Nodemailer SMTP reply parser denial of service (event loop starvation / memory exhaustion)</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos,availability,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations.

   • Do not connect Nodemailer clients to SMTP servers outside your trust boundary; enforce TLS with certificate pinning to prevent on-path injection.
   • Bound resources: apply process/container memory limits, set socket timeouts, and place mail-sending workers in isolated processes so a hung parser cannot starve co-located services.
   • Cap the amount of server reply data buffered, and enforce a maximum number of continuation lines at the connection layer (reverse proxy / SMTP gateway enforcement).

2. Patch/upgrade steps.

   • No patch is currently available from any tracked source. The vulnerable range is 3.0.0 through before 10.0.10; upgrade to 10.0.10 or later only once an official release is confirmed to contain a fix. Monitor the Nodemailer project for an advisory and track the CVE record for updates. Until then, treat deployments in the affected range as unpatched.

3. Long-term hardening.

   • Treat SMTP server replies as untrusted input; validate server identity and enforce reply-size and reply-line-count ceilings.
   • Adopt defensive parsing patterns that reject or truncate over-long multi-line replies rather than buffering indefinitely.
   • Integrate SBOM-based version tracking to detect vulnerable Nodemailer versions and enforce egress allowlisting for outbound SMTP so only approved relays are reachable.
   • Enable runtime detection for event-loop lag and OOM signals to catch availability attacks early.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-110872
• Nodemailer project: https://github.com/nodemailer/nodemailer
• Node.js security releases: https://nodejs.org/en/security
• CWE-400 (Uncontrolled Resource Consumption): https://cwe.mitre.org/data/definitions/400.html
• No CISA KEV listing; no known threat actor campaigns or exploit-in-the-wild evidence for this CVE as of this writing.