CVE-2026-38728

Executive Summary

CVE-2026-38728 is a denial-of-service vulnerability in Nodemailer smtp_server versions before 3.18.3. The flaw resides in the SMTPStream._write method within lib/smtp-stream.js and permits remote, unauthenticated attackers to exhaust server resources. Affected systems include any Node.js application exposing an SMTP listener using the vulnerable Nodemailer component, resulting in service disruption with a CVSS 7.5 High rating.

Technical Analysis

The vulnerability stems from insufficient bounds checking and resource management in SMTPStream._write. When processing incoming SMTP data, the function appends chunks to internal buffers without enforcing size limits or rate controls on malformed or excessively long commands. This triggers uncontrolled resource consumption (CWE-400) as memory allocation grows unbounded or CPU cycles are consumed parsing repeated invalid sequences. Attack surface centers on the TCP port listening for SMTP connections, typically 25, 587, or 465. No authentication is required, and the vector is network-reachable. The root cause is absence of input validation or back-pressure mechanisms before the fix in 3.18.3.

Exploitation Scenarios

1. Reconnaissance identifies exposed Nodemailer SMTP endpoints via port scans or Shodan queries for smtp-stream signatures. 2) Attacker opens a TCP connection and sends a continuous stream of oversized or repeated SMTP commands (e.g., repeated EHLO with 10KB payloads) directly to SMTPStream._write. 3) The method accumulates data without truncation, rapidly increasing heap usage until the Node.js process exhausts available memory or CPU. 4) Post-exploitation the listener becomes unresponsive, dropping legitimate mail sessions and requiring process restart for recovery. (No public exploit code exists.)

Impact Assessment

Business impact includes prolonged email service outages for any application relying on the vulnerable Nodemailer SMTP server component. Blast radius covers all internet-facing or internal SMTP listeners using versions prior to 3.18.3. CVSS subscores reflect full network attack vector, low complexity, and high availability impact with no confidentiality or integrity loss. Systems handling high mail volumes face the greatest operational disruption.

Detection Guidance

Sigma Rule

title: Nodemailer SMTP DoS via SMTPStream
id: 8f3c2a1b-4e5d-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects excessive SMTP data patterns indicative of CVE-2026-38728 exploitation
logsource:
  product: suricata
  category: network
detection:
  selection:
    event_type: alert
    alert.signature_id: 202638728
  condition: selection

YARA Rule

rule Nodemailer_SMTPStream_DoS {
    meta:
        description = "Detects patterns linked to CVE-2026-38728 in Nodemailer"
    strings:
        $smtp_write = "SMTPStream._write"
        $lib_path = "lib/smtp-stream.js"
    condition:
        any of them
}

Suricata IDS Rule

alert tcp any any -> any 25,587,465 (msg:"Nodemailer SMTP DoS attempt CVE-2026-38728"; flow:established,to_server; content:"EHLO"; depth:5; threshold:type both, track by_src, count 100, seconds 10; classtype:attempted-dos; sid:202638728; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where destination.port in (25,587,465) and network.protocol == "smtp"]
  [network where event.action == "flow" and network.bytes > 1000000]

Splunk SPL Query

index=network sourcetype=suricata OR sourcetype=firewall dest_port IN (25,587,465) protocol=smtp | stats count by src_ip | where count > 100

Wazuh OSSEC Rule

<rule id="100001" level="10">
  <if_sid>100000</if_sid>
  <match>SMTPStream._write</match>
  <description>Possible CVE-2026-38728 DoS in Nodemailer</description>
</rule>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)). 1) Immediate mitigations include rate-limiting SMTP connections at the network layer and deploying WAF rules to drop oversized EHLO/HELO commands. 2) Patch/upgrade steps require updating Nodemailer to version 3.18.3 or later via npm install nodemailer@latest and restarting affected services. 3) Long-term hardening involves implementing connection timeouts, input size caps on SMTP commands, and migrating to alternative mail libraries with built-in resource guards.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-38728 https://github.com/nodemailer/nodemailer https://osv.dev/vulnerability/CVE-2026-38728 No known threat actor campaigns or in-the-wild exploitation recorded as of current data.