{"schema_version":"2","view":"grouped","data":[{"id":42486,"cve_ids":["CVE-2026-110871"],"payload":{"kind":"advisory","title":"Nodemailer 3.0.0 before 10.0.10 Quadratic DKIM Header Unfolding Denial of Service","summary":"Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers that fold into tens of thousands of continuation lines, blocking the Node.js event loop during DKIM signing.","evidence":"cve:CVE-2026-110871","products":[{"name":{"value":"nodemailer","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-110871","aliases":["CVE-2026-110871"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"nodemailer","product":"nodemailer","versions":[{"status":"affected","version":"3.0.0","lessThan":"10.0.10","versionType":"semver"},{"status":"unaffected","version":"10.0.10","versionType":"semver"}],"packageURL":"pkg:npm/nodemailer","defaultStatus":"unaffected"}],"modified":"2026-10-20T02:28:10.449Z","provider":"cve","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-39m8-27wv-hr27","https://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.0.10-quadratic-dkim-header-unfolding-denial-of-service"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-110871","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-20T02:27:46.223988Z"}}}],"references":[{"url":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-39m8-27wv-hr27","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-20T02:28:10.449Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-14T22:52:59.681Z"}}},"related_cves":[{"value":"CVE-2026-110871","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:7ce030cc-dad0-4878-aec3-04916632ae60","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-110871","advisory_id":"7ce030cc-dad0-4878-aec3-04916632ae60","event_types":["advisory"],"published_at":"2026-10-25T11:39:02.015819+00:00","technologies":["core-cve","nodemailer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-14T22:52:59.681+00:00","detail_url":"/advisories/advisory%3A7ce030cc-dad0-4878-aec3-04916632ae60","group":{"id":"advisory:7ce030cc-dad0-4878-aec3-04916632ae60","revision":1,"primary_event_id":42095,"change":"published","superseded_by":[],"changed":{"id":42095,"cve_ids":["CVE-2026-110871"],"payload":{"kind":"advisory","title":"Nodemailer 3.0.0 before 10.0.10 Quadratic DKIM Header Unfolding Denial of Service","summary":"Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers that fold into tens of thousands of continuation lines, blocking the Node.js event loop during DKIM signing.","evidence":"cve:CVE-2026-110871","products":[{"name":{"value":"nodemailer","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-110871","aliases":["CVE-2026-110871"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"nodemailer","product":"nodemailer","versions":[{"status":"affected","version":"3.0.0","lessThan":"10.0.10","versionType":"semver"},{"status":"unaffected","version":"10.0.10","versionType":"semver"}],"packageURL":"pkg:npm/nodemailer","defaultStatus":"unaffected"}],"modified":"2026-10-20T02:28:10.449Z","provider":"cve","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-39m8-27wv-hr27","https://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.0.10-quadratic-dkim-header-unfolding-denial-of-service"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-110871","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-20T02:27:46.223988Z"}}}],"references":[{"url":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-39m8-27wv-hr27","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-20T02:28:10.449Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-14T22:52:59.681Z"}}},"related_cves":[{"value":"CVE-2026-110871","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:7ce030cc-dad0-4878-aec3-04916632ae60","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-110871","advisory_id":"7ce030cc-dad0-4878-aec3-04916632ae60","event_types":["advisory"],"published_at":"2026-10-25T11:39:02.015819+00:00","technologies":["core-cve","nodemailer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-14T22:52:59.681+00:00","detail_url":"/events/42095"},"members":[{"id":42095,"cve_ids":["CVE-2026-110871"],"payload":{"kind":"advisory","title":"Nodemailer 3.0.0 before 10.0.10 Quadratic DKIM Header Unfolding Denial of Service","summary":"Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers that fold into tens of thousands of continuation lines, blocking the Node.js event loop during DKIM signing.","evidence":"cve:CVE-2026-110871","products":[{"name":{"value":"nodemailer","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-110871","aliases":["CVE-2026-110871"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"nodemailer","product":"nodemailer","versions":[{"status":"affected","version":"3.0.0","lessThan":"10.0.10","versionType":"semver"},{"status":"unaffected","version":"10.0.10","versionType":"semver"}],"packageURL":"pkg:npm/nodemailer","defaultStatus":"unaffected"}],"modified":"2026-10-20T02:28:10.449Z","provider":"cve","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-39m8-27wv-hr27","https://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.0.10-quadratic-dkim-header-unfolding-denial-of-service"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-110871","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-20T02:27:46.223988Z"}}}],"references":[{"url":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-39m8-27wv-hr27","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-20T02:28:10.449Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-14T22:52:59.681Z"}}},"related_cves":[{"value":"CVE-2026-110871","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:7ce030cc-dad0-4878-aec3-04916632ae60","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-110871","advisory_id":"7ce030cc-dad0-4878-aec3-04916632ae60","event_types":["advisory"],"published_at":"2026-10-25T11:39:02.015819+00:00","technologies":["core-cve","nodemailer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-14T22:52:59.681+00:00","detail_url":"/events/42095"}]}},{"id":29268,"cve_ids":["CVE-2026-110869"],"payload":{"kind":"advisory","title":"Nodemailer 3.0.0 before 10.0.13 ReDoS via SMTP AUTH Mechanism Detection Regexes","summary":"Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or man-in-the-middle SMTP server can reply to EHLO with 250-AUTH, a long whitespace run and a non-matching token, blocking the Node.js event loop for tens of seconds to hours before authentication.","evidence":"cve:CVE-2026-110869","products":[{"name":{"value":"nodemailer","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-110869","aliases":["CVE-2026-110869"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"nodemailer","product":"nodemailer","versions":[{"status":"affected","version":"3.0.0","lessThan":"10.0.13","versionType":"semver"},{"status":"unaffected","version":"10.0.13","versionType":"semver"}],"packageURL":"pkg:npm/nodemailer","defaultStatus":"unaffected"}],"modified":"2026-10-15T15:35:29.075Z","provider":"cve","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-4ffr-jq9g-5ffx","https://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.0.13-redos-via-smtp-auth-mechanism-detection-regexes"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-110869","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T15:35:06.757255Z"}}}],"references":[{"url":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-4ffr-jq9g-5ffx","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T15:35:29.075Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-14T22:52:57.866Z"}}},"related_cves":[{"value":"CVE-2026-110869","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:b6d0bf97-a4a8-47bc-8adc-87a64dce0c4c","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-110869","advisory_id":"b6d0bf97-a4a8-47bc-8adc-87a64dce0c4c","event_types":["advisory"],"published_at":"2026-10-25T07:52:00.114512+00:00","technologies":["core-cve","nodemailer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-14T22:52:57.866+00:00","detail_url":"/advisories/advisory%3Ab6d0bf97-a4a8-47bc-8adc-87a64dce0c4c","group":{"id":"advisory:b6d0bf97-a4a8-47bc-8adc-87a64dce0c4c","revision":1,"primary_event_id":29037,"change":"published","superseded_by":[],"changed":{"id":29037,"cve_ids":["CVE-2026-110869"],"payload":{"kind":"advisory","title":"Nodemailer 3.0.0 before 10.0.13 ReDoS via SMTP AUTH Mechanism Detection Regexes","summary":"Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or man-in-the-middle SMTP server can reply to EHLO with 250-AUTH, a long whitespace run and a non-matching token, blocking the Node.js event loop for tens of seconds to hours before authentication.","evidence":"cve:CVE-2026-110869","products":[{"name":{"value":"nodemailer","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-110869","aliases":["CVE-2026-110869"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"nodemailer","product":"nodemailer","versions":[{"status":"affected","version":"3.0.0","lessThan":"10.0.13","versionType":"semver"},{"status":"unaffected","version":"10.0.13","versionType":"semver"}],"packageURL":"pkg:npm/nodemailer","defaultStatus":"unaffected"}],"modified":"2026-10-15T15:35:29.075Z","provider":"cve","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-4ffr-jq9g-5ffx","https://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.0.13-redos-via-smtp-auth-mechanism-detection-regexes"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-110869","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T15:35:06.757255Z"}}}],"references":[{"url":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-4ffr-jq9g-5ffx","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T15:35:29.075Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-14T22:52:57.866Z"}}},"related_cves":[{"value":"CVE-2026-110869","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:b6d0bf97-a4a8-47bc-8adc-87a64dce0c4c","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-110869","advisory_id":"b6d0bf97-a4a8-47bc-8adc-87a64dce0c4c","event_types":["advisory"],"published_at":"2026-10-25T07:52:00.114512+00:00","technologies":["core-cve","nodemailer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-14T22:52:57.866+00:00","detail_url":"/events/29037"},"members":[{"id":29037,"cve_ids":["CVE-2026-110869"],"payload":{"kind":"advisory","title":"Nodemailer 3.0.0 before 10.0.13 ReDoS via SMTP AUTH Mechanism Detection Regexes","summary":"Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or man-in-the-middle SMTP server can reply to EHLO with 250-AUTH, a long whitespace run and a non-matching token, blocking the Node.js event loop for tens of seconds to hours before authentication.","evidence":"cve:CVE-2026-110869","products":[{"name":{"value":"nodemailer","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-110869","aliases":["CVE-2026-110869"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"nodemailer","product":"nodemailer","versions":[{"status":"affected","version":"3.0.0","lessThan":"10.0.13","versionType":"semver"},{"status":"unaffected","version":"10.0.13","versionType":"semver"}],"packageURL":"pkg:npm/nodemailer","defaultStatus":"unaffected"}],"modified":"2026-10-15T15:35:29.075Z","provider":"cve","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-4ffr-jq9g-5ffx","https://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.0.13-redos-via-smtp-auth-mechanism-detection-regexes"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-110869","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T15:35:06.757255Z"}}}],"references":[{"url":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-4ffr-jq9g-5ffx","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T15:35:29.075Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-14T22:52:57.866Z"}}},"related_cves":[{"value":"CVE-2026-110869","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:b6d0bf97-a4a8-47bc-8adc-87a64dce0c4c","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-110869","advisory_id":"b6d0bf97-a4a8-47bc-8adc-87a64dce0c4c","event_types":["advisory"],"published_at":"2026-10-25T07:52:00.114512+00:00","technologies":["core-cve","nodemailer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-14T22:52:57.866+00:00","detail_url":"/events/29037"}]}},{"id":28929,"cve_ids":["CVE-2026-110872"],"payload":{"kind":"advisory","title":"Nodemailer 3.0.0 before 10.0.10 Denial of Service via SMTP Reply Parsing","summary":"Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection._onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before authentication, blocking the Node.js event loop and exhausting memory.","evidence":"cve:CVE-2026-110872","products":[{"name":{"value":"nodemailer","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-110872","aliases":["CVE-2026-110872"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"nodemailer","product":"nodemailer","versions":[{"status":"affected","version":"3.0.0","lessThan":"10.0.10","versionType":"semver"},{"status":"unaffected","version":"10.0.10","versionType":"semver"}],"packageURL":"pkg:npm/nodemailer","defaultStatus":"unaffected"}],"modified":"2026-10-15T13:30:56.785Z","provider":"cve","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-4g23-2xm8-66gc","https://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.0.10-denial-of-service-via-smtp-reply-parsing"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-110872","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T13:29:48.697322Z"}}}],"references":[{"url":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-4g23-2xm8-66gc","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T13:30:56.785Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-14T22:53:00.625Z"}}},"related_cves":[{"value":"CVE-2026-110872","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:d2daae97-18fd-43b4-b2e9-205422617813","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-110872","advisory_id":"d2daae97-18fd-43b4-b2e9-205422617813","event_types":["advisory"],"published_at":"2026-10-25T07:47:01.88731+00:00","technologies":["core-cve","nodemailer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-14T22:53:00.625+00:00","detail_url":"/advisories/advisory%3Ad2daae97-18fd-43b4-b2e9-205422617813","group":{"id":"advisory:d2daae97-18fd-43b4-b2e9-205422617813","revision":1,"primary_event_id":28703,"change":"published","superseded_by":[],"changed":{"id":28703,"cve_ids":["CVE-2026-110872"],"payload":{"kind":"advisory","title":"Nodemailer 3.0.0 before 10.0.10 Denial of Service via SMTP Reply Parsing","summary":"Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection._onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before authentication, blocking the Node.js event loop and exhausting memory.","evidence":"cve:CVE-2026-110872","products":[{"name":{"value":"nodemailer","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-110872","aliases":["CVE-2026-110872"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"nodemailer","product":"nodemailer","versions":[{"status":"affected","version":"3.0.0","lessThan":"10.0.10","versionType":"semver"},{"status":"unaffected","version":"10.0.10","versionType":"semver"}],"packageURL":"pkg:npm/nodemailer","defaultStatus":"unaffected"}],"modified":"2026-10-15T13:30:56.785Z","provider":"cve","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-4g23-2xm8-66gc","https://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.0.10-denial-of-service-via-smtp-reply-parsing"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-110872","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T13:29:48.697322Z"}}}],"references":[{"url":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-4g23-2xm8-66gc","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T13:30:56.785Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-14T22:53:00.625Z"}}},"related_cves":[{"value":"CVE-2026-110872","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:d2daae97-18fd-43b4-b2e9-205422617813","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-110872","advisory_id":"d2daae97-18fd-43b4-b2e9-205422617813","event_types":["advisory"],"published_at":"2026-10-25T07:47:01.88731+00:00","technologies":["core-cve","nodemailer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-14T22:53:00.625+00:00","detail_url":"/events/28703"},"members":[{"id":28703,"cve_ids":["CVE-2026-110872"],"payload":{"kind":"advisory","title":"Nodemailer 3.0.0 before 10.0.10 Denial of Service via SMTP Reply Parsing","summary":"Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection._onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before authentication, blocking the Node.js event loop and exhausting memory.","evidence":"cve:CVE-2026-110872","products":[{"name":{"value":"nodemailer","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-110872","aliases":["CVE-2026-110872"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"nodemailer","product":"nodemailer","versions":[{"status":"affected","version":"3.0.0","lessThan":"10.0.10","versionType":"semver"},{"status":"unaffected","version":"10.0.10","versionType":"semver"}],"packageURL":"pkg:npm/nodemailer","defaultStatus":"unaffected"}],"modified":"2026-10-15T13:30:56.785Z","provider":"cve","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-4g23-2xm8-66gc","https://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.0.10-denial-of-service-via-smtp-reply-parsing"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-110872","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T13:29:48.697322Z"}}}],"references":[{"url":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-4g23-2xm8-66gc","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T13:30:56.785Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-14T22:53:00.625Z"}}},"related_cves":[{"value":"CVE-2026-110872","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:d2daae97-18fd-43b4-b2e9-205422617813","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-110872","advisory_id":"d2daae97-18fd-43b4-b2e9-205422617813","event_types":["advisory"],"published_at":"2026-10-25T07:47:01.88731+00:00","technologies":["core-cve","nodemailer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-14T22:53:00.625+00:00","detail_url":"/events/28703"}]}},{"id":24494,"cve_ids":["CVE-2026-110870"],"payload":{"kind":"advisory","title":"Nodemailer before 10.0.13 Improper Input Validation via Angle-Bracket Address Comments","summary":"Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal characters reach envelope.to and RCPT TO, causing rejected delivery or parser interpretation conflicts that bypass domain allow-lists.","evidence":"cve:CVE-2026-110870","products":[{"name":{"value":"nodemailer","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-110870","aliases":["CVE-2026-110870"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"nodemailer","product":"nodemailer","versions":[{"status":"affected","version":"3.0.0","lessThan":"10.0.13","versionType":"semver"},{"status":"unaffected","version":"10.0.13","versionType":"semver"}],"packageURL":"pkg:npm/nodemailer","defaultStatus":"unaffected"}],"modified":"2026-10-14T22:52:58.787Z","provider":"cve","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-g73g-hqqh-jr95","https://www.vulncheck.com/advisories/nodemailer-before-10.0.13-improper-input-validation-via-angle-bracket-address-comments"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-14T22:52:58.787Z"}}},"related_cves":[{"value":"CVE-2026-110870","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1b442d3f-dd94-465e-9c4f-eca8eb2094bd","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-110870","advisory_id":"1b442d3f-dd94-465e-9c4f-eca8eb2094bd","event_types":["advisory"],"published_at":"2026-10-25T06:33:29.458475+00:00","technologies":["core-cve","nodemailer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-14T22:52:58.787+00:00","detail_url":"/advisories/advisory%3A1b442d3f-dd94-465e-9c4f-eca8eb2094bd","group":{"id":"advisory:1b442d3f-dd94-465e-9c4f-eca8eb2094bd","revision":1,"primary_event_id":24328,"change":"published","superseded_by":[],"changed":{"id":24328,"cve_ids":["CVE-2026-110870"],"payload":{"kind":"advisory","title":"Nodemailer before 10.0.13 Improper Input Validation via Angle-Bracket Address Comments","summary":"Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal characters reach envelope.to and RCPT TO, causing rejected delivery or parser interpretation conflicts that bypass domain allow-lists.","evidence":"cve:CVE-2026-110870","products":[{"name":{"value":"nodemailer","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-110870","aliases":["CVE-2026-110870"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"nodemailer","product":"nodemailer","versions":[{"status":"affected","version":"3.0.0","lessThan":"10.0.13","versionType":"semver"},{"status":"unaffected","version":"10.0.13","versionType":"semver"}],"packageURL":"pkg:npm/nodemailer","defaultStatus":"unaffected"}],"modified":"2026-10-14T22:52:58.787Z","provider":"cve","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-g73g-hqqh-jr95","https://www.vulncheck.com/advisories/nodemailer-before-10.0.13-improper-input-validation-via-angle-bracket-address-comments"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-14T22:52:58.787Z"}}},"related_cves":[{"value":"CVE-2026-110870","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1b442d3f-dd94-465e-9c4f-eca8eb2094bd","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-110870","advisory_id":"1b442d3f-dd94-465e-9c4f-eca8eb2094bd","event_types":["advisory"],"published_at":"2026-10-25T06:33:29.458475+00:00","technologies":["core-cve","nodemailer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-14T22:52:58.787+00:00","detail_url":"/events/24328"},"members":[{"id":24328,"cve_ids":["CVE-2026-110870"],"payload":{"kind":"advisory","title":"Nodemailer before 10.0.13 Improper Input Validation via Angle-Bracket Address Comments","summary":"Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal characters reach envelope.to and RCPT TO, causing rejected delivery or parser interpretation conflicts that bypass domain allow-lists.","evidence":"cve:CVE-2026-110870","products":[{"name":{"value":"nodemailer","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-110870","aliases":["CVE-2026-110870"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"nodemailer","product":"nodemailer","versions":[{"status":"affected","version":"3.0.0","lessThan":"10.0.13","versionType":"semver"},{"status":"unaffected","version":"10.0.13","versionType":"semver"}],"packageURL":"pkg:npm/nodemailer","defaultStatus":"unaffected"}],"modified":"2026-10-14T22:52:58.787Z","provider":"cve","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-g73g-hqqh-jr95","https://www.vulncheck.com/advisories/nodemailer-before-10.0.13-improper-input-validation-via-angle-bracket-address-comments"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-14T22:52:58.787Z"}}},"related_cves":[{"value":"CVE-2026-110870","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1b442d3f-dd94-465e-9c4f-eca8eb2094bd","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-110870","advisory_id":"1b442d3f-dd94-465e-9c4f-eca8eb2094bd","event_types":["advisory"],"published_at":"2026-10-25T06:33:29.458475+00:00","technologies":["core-cve","nodemailer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-14T22:52:58.787+00:00","detail_url":"/events/24328"}]}},{"id":12987,"cve_ids":["CVE-2026-82854"],"payload":{"kind":"advisory","title":"Nodemailer before 8.0.3 SMTP Command Injection via envelope.size","summary":"Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope object with a size property containing CRLF characters to sendMail(), the value is concatenated into the SMTP MAIL FROM command (as SIZE=...) without sanitization, allowing injection of arbitrary SMTP commands such as RCPT TO to silently add attacker-controlled recipients. Exploitation requires the application to expose the envelope size to attacker-controlled input, as Nodemailer does not include size in the default auto-constructed envelope.","evidence":"cve:CVE-2026-82854","products":[{"name":{"value":"nodemailer","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-82854","aliases":["CVE-2026-82854"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":9.3,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"CRITICAL","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"nodemailer","product":"nodemailer","versions":[{"status":"affected","version":"0","lessThan":"8.0.3","versionType":"semver"},{"status":"unaffected","version":"8.0.3","versionType":"semver"}],"packageURL":"pkg:npm/nodemailer","defaultStatus":"unaffected"}],"modified":"2026-10-08T15:25:32.582Z","provider":"cve","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-c7w3-x93f-qmm8","https://www.vulncheck.com/advisories/nodemailer-before-8.0.3-smtp-command-injection-via-envelope-size"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-82854","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-08-31T16:46:43.285974Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-31T18:52:03.366Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-08T15:25:32.582Z"}}},"related_cves":[{"value":"CVE-2026-82854","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:0bd41be4-abd4-4f22-8330-664772a8e97b","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-82854","advisory_id":"0bd41be4-abd4-4f22-8330-664772a8e97b","event_types":["advisory"],"published_at":"2026-10-25T00:15:53.623248+00:00","technologies":["core-cve","nodemailer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-31T08:46:28.405+00:00","detail_url":"/advisories/advisory%3A0bd41be4-abd4-4f22-8330-664772a8e97b","group":{"id":"advisory:0bd41be4-abd4-4f22-8330-664772a8e97b","revision":1,"primary_event_id":12920,"change":"published","superseded_by":[],"changed":{"id":12920,"cve_ids":["CVE-2026-82854"],"payload":{"kind":"advisory","title":"Nodemailer before 8.0.3 SMTP Command Injection via envelope.size","summary":"Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope object with a size property containing CRLF characters to sendMail(), the value is concatenated into the SMTP MAIL FROM command (as SIZE=...) without sanitization, allowing injection of arbitrary SMTP commands such as RCPT TO to silently add attacker-controlled recipients. Exploitation requires the application to expose the envelope size to attacker-controlled input, as Nodemailer does not include size in the default auto-constructed envelope.","evidence":"cve:CVE-2026-82854","products":[{"name":{"value":"nodemailer","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-82854","aliases":["CVE-2026-82854"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":9.3,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"CRITICAL","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"nodemailer","product":"nodemailer","versions":[{"status":"affected","version":"0","lessThan":"8.0.3","versionType":"semver"},{"status":"unaffected","version":"8.0.3","versionType":"semver"}],"packageURL":"pkg:npm/nodemailer","defaultStatus":"unaffected"}],"modified":"2026-10-08T15:25:32.582Z","provider":"cve","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-c7w3-x93f-qmm8","https://www.vulncheck.com/advisories/nodemailer-before-8.0.3-smtp-command-injection-via-envelope-size"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-82854","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-08-31T16:46:43.285974Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-31T18:52:03.366Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-08T15:25:32.582Z"}}},"related_cves":[{"value":"CVE-2026-82854","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:0bd41be4-abd4-4f22-8330-664772a8e97b","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-82854","advisory_id":"0bd41be4-abd4-4f22-8330-664772a8e97b","event_types":["advisory"],"published_at":"2026-10-25T00:15:53.623248+00:00","technologies":["core-cve","nodemailer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-31T08:46:28.405+00:00","detail_url":"/events/12920"},"members":[{"id":12920,"cve_ids":["CVE-2026-82854"],"payload":{"kind":"advisory","title":"Nodemailer before 8.0.3 SMTP Command Injection via envelope.size","summary":"Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope object with a size property containing CRLF characters to sendMail(), the value is concatenated into the SMTP MAIL FROM command (as SIZE=...) without sanitization, allowing injection of arbitrary SMTP commands such as RCPT TO to silently add attacker-controlled recipients. Exploitation requires the application to expose the envelope size to attacker-controlled input, as Nodemailer does not include size in the default auto-constructed envelope.","evidence":"cve:CVE-2026-82854","products":[{"name":{"value":"nodemailer","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-82854","aliases":["CVE-2026-82854"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":9.3,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"CRITICAL","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"nodemailer","product":"nodemailer","versions":[{"status":"affected","version":"0","lessThan":"8.0.3","versionType":"semver"},{"status":"unaffected","version":"8.0.3","versionType":"semver"}],"packageURL":"pkg:npm/nodemailer","defaultStatus":"unaffected"}],"modified":"2026-10-08T15:25:32.582Z","provider":"cve","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-c7w3-x93f-qmm8","https://www.vulncheck.com/advisories/nodemailer-before-8.0.3-smtp-command-injection-via-envelope-size"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-82854","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-08-31T16:46:43.285974Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-31T18:52:03.366Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-08T15:25:32.582Z"}}},"related_cves":[{"value":"CVE-2026-82854","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:0bd41be4-abd4-4f22-8330-664772a8e97b","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-82854","advisory_id":"0bd41be4-abd4-4f22-8330-664772a8e97b","event_types":["advisory"],"published_at":"2026-10-25T00:15:53.623248+00:00","technologies":["core-cve","nodemailer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-31T08:46:28.405+00:00","detail_url":"/events/12920"}]}},{"id":3243,"cve_ids":["CVE-2026-100699"],"payload":{"kind":"advisory","title":"Nodemailer before 10.0.9 Malformed Envelope Recipient via RFC 5322 Comment","summary":"Nodemailer is a Node.js email-sending library. In versions >= 9.1.0 and < 10.0.9, the address parser (src/addressparser) mishandles addresses whose local-part is a quoted string and that are followed by RFC 5322 comments, allowing trailing comment-separated domain atoms to be retained in the normalized address. For example, the input \"user\"@example.com(x)evil.com is parsed to the address value 'user@example.com evil.com', which contains additional attacker-controlled domain text separated by a literal space. This parsed value is used without further strict recipient validation when the message envelope is built (envelope.to in src/mime-node), so a malformed/ambiguous recipient address can be accepted and placed in the SMTP envelope. Whether this results in delivery to an unintended recipient on real SMTP servers has not been confirmed. The issue is a variant of the RFC 5322 comment parsing problem addressed in GHSA-cc9r-2j5m-2m83, affecting the separate quoted-local-part code path. Version 10.0.9 contains a fix.","evidence":"cve:CVE-2026-100699","products":[{"name":{"value":"nodemailer","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-100699","aliases":["CVE-2026-100699"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"nodemailer","product":"nodemailer","versions":[{"status":"affected","version":"9.1.0","lessThan":"10.0.9","versionType":"semver"},{"status":"unaffected","version":"10.0.9","versionType":"semver"}],"packageURL":"pkg:npm/nodemailer","defaultStatus":"unaffected"}],"modified":"2026-09-28T17:43:19.483Z","provider":"cve","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-g57g-f23g-4646","https://www.vulncheck.com/advisories/nodemailer-before-10.0.9-malformed-envelope-recipient-via-rfc-5322-comment"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100699","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T17:42:55.592537Z"}}}],"references":[{"url":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-g57g-f23g-4646","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T17:43:19.483Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:55.786Z"}}},"related_cves":[{"value":"CVE-2026-100699","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:f6f853cb-553f-4558-adc8-d8e459ddbbe5","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100699","advisory_id":"f6f853cb-553f-4558-adc8-d8e459ddbbe5","event_types":["advisory"],"published_at":"2026-10-24T21:31:50.961569+00:00","technologies":["core-cve","nodemailer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:55.786+00:00","detail_url":"/advisories/advisory%3Af6f853cb-553f-4558-adc8-d8e459ddbbe5","group":{"id":"advisory:f6f853cb-553f-4558-adc8-d8e459ddbbe5","revision":1,"primary_event_id":3255,"change":"published","superseded_by":[],"changed":{"id":3255,"cve_ids":["CVE-2026-100699"],"payload":{"kind":"advisory","title":"Nodemailer before 10.0.9 Malformed Envelope Recipient via RFC 5322 Comment","summary":"Nodemailer is a Node.js email-sending library. In versions >= 9.1.0 and < 10.0.9, the address parser (src/addressparser) mishandles addresses whose local-part is a quoted string and that are followed by RFC 5322 comments, allowing trailing comment-separated domain atoms to be retained in the normalized address. For example, the input \"user\"@example.com(x)evil.com is parsed to the address value 'user@example.com evil.com', which contains additional attacker-controlled domain text separated by a literal space. This parsed value is used without further strict recipient validation when the message envelope is built (envelope.to in src/mime-node), so a malformed/ambiguous recipient address can be accepted and placed in the SMTP envelope. Whether this results in delivery to an unintended recipient on real SMTP servers has not been confirmed. The issue is a variant of the RFC 5322 comment parsing problem addressed in GHSA-cc9r-2j5m-2m83, affecting the separate quoted-local-part code path. Version 10.0.9 contains a fix.","evidence":"cve:CVE-2026-100699","products":[{"name":{"value":"nodemailer","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-100699","aliases":["CVE-2026-100699"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"nodemailer","product":"nodemailer","versions":[{"status":"affected","version":"9.1.0","lessThan":"10.0.9","versionType":"semver"},{"status":"unaffected","version":"10.0.9","versionType":"semver"}],"packageURL":"pkg:npm/nodemailer","defaultStatus":"unaffected"}],"modified":"2026-09-28T17:43:19.483Z","provider":"cve","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-g57g-f23g-4646","https://www.vulncheck.com/advisories/nodemailer-before-10.0.9-malformed-envelope-recipient-via-rfc-5322-comment"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100699","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T17:42:55.592537Z"}}}],"references":[{"url":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-g57g-f23g-4646","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T17:43:19.483Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:55.786Z"}}},"related_cves":[{"value":"CVE-2026-100699","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:f6f853cb-553f-4558-adc8-d8e459ddbbe5","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100699","advisory_id":"f6f853cb-553f-4558-adc8-d8e459ddbbe5","event_types":["advisory"],"published_at":"2026-10-24T21:31:50.961569+00:00","technologies":["core-cve","nodemailer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:55.786+00:00","detail_url":"/events/3255"},"members":[{"id":3255,"cve_ids":["CVE-2026-100699"],"payload":{"kind":"advisory","title":"Nodemailer before 10.0.9 Malformed Envelope Recipient via RFC 5322 Comment","summary":"Nodemailer is a Node.js email-sending library. In versions >= 9.1.0 and < 10.0.9, the address parser (src/addressparser) mishandles addresses whose local-part is a quoted string and that are followed by RFC 5322 comments, allowing trailing comment-separated domain atoms to be retained in the normalized address. For example, the input \"user\"@example.com(x)evil.com is parsed to the address value 'user@example.com evil.com', which contains additional attacker-controlled domain text separated by a literal space. This parsed value is used without further strict recipient validation when the message envelope is built (envelope.to in src/mime-node), so a malformed/ambiguous recipient address can be accepted and placed in the SMTP envelope. Whether this results in delivery to an unintended recipient on real SMTP servers has not been confirmed. The issue is a variant of the RFC 5322 comment parsing problem addressed in GHSA-cc9r-2j5m-2m83, affecting the separate quoted-local-part code path. Version 10.0.9 contains a fix.","evidence":"cve:CVE-2026-100699","products":[{"name":{"value":"nodemailer","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-100699","aliases":["CVE-2026-100699"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"nodemailer","product":"nodemailer","versions":[{"status":"affected","version":"9.1.0","lessThan":"10.0.9","versionType":"semver"},{"status":"unaffected","version":"10.0.9","versionType":"semver"}],"packageURL":"pkg:npm/nodemailer","defaultStatus":"unaffected"}],"modified":"2026-09-28T17:43:19.483Z","provider":"cve","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-g57g-f23g-4646","https://www.vulncheck.com/advisories/nodemailer-before-10.0.9-malformed-envelope-recipient-via-rfc-5322-comment"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100699","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T17:42:55.592537Z"}}}],"references":[{"url":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-g57g-f23g-4646","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T17:43:19.483Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:55.786Z"}}},"related_cves":[{"value":"CVE-2026-100699","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:f6f853cb-553f-4558-adc8-d8e459ddbbe5","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100699","advisory_id":"f6f853cb-553f-4558-adc8-d8e459ddbbe5","event_types":["advisory"],"published_at":"2026-10-24T21:31:50.961569+00:00","technologies":["core-cve","nodemailer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:55.786+00:00","detail_url":"/events/3255"}]}},{"id":3144,"cve_ids":["CVE-2026-100700"],"payload":{"kind":"advisory","title":"nodemailer before 10.0.6 Denial of Service via addressparser","summary":"nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking behavior. Attackers can supply crafted email header values with long whitespace-free runs to block the Node.js event loop for tens of seconds, causing service unavailability.","evidence":"cve:CVE-2026-100700","products":[{"name":{"value":"nodemailer","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100700","aliases":["CVE-2026-100700"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"nodemailer","product":"nodemailer","versions":[{"status":"affected","version":"0","lessThan":"10.0.6","versionType":"semver"},{"status":"unaffected","version":"10.0.6","versionType":"semver"}],"packageURL":"pkg:npm/nodemailer","defaultStatus":"unaffected"}],"modified":"2026-09-28T15:01:54.036Z","provider":"cve","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-v53p-9fqp-m79j","https://www.vulncheck.com/advisories/nodemailer-before-10.0.6-denial-of-service-via-addressparser"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100700","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T15:00:18.660649Z"}}}],"references":[{"url":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-v53p-9fqp-m79j","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T15:01:54.036Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:56.526Z"}}},"related_cves":[{"value":"CVE-2026-100700","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:7f27d1c8-1d75-44a5-a162-2809a326e74c","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-100700","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"nodemailer","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"10.0.6","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v53p-9fqp-m79j","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100700","advisory_id":"7f27d1c8-1d75-44a5-a162-2809a326e74c","event_types":["advisory"],"published_at":"2026-10-24T21:30:48.152375+00:00","technologies":["core-cve","nodemailer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:56.526+00:00","detail_url":"/advisories/advisory%3A7f27d1c8-1d75-44a5-a162-2809a326e74c","group":{"id":"advisory:7f27d1c8-1d75-44a5-a162-2809a326e74c","revision":1,"primary_event_id":3155,"change":"published","superseded_by":[],"changed":{"id":3155,"cve_ids":["CVE-2026-100700"],"payload":{"kind":"advisory","title":"nodemailer before 10.0.6 Denial of Service via addressparser","summary":"nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking behavior. Attackers can supply crafted email header values with long whitespace-free runs to block the Node.js event loop for tens of seconds, causing service unavailability.","evidence":"cve:CVE-2026-100700","products":[{"name":{"value":"nodemailer","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100700","aliases":["CVE-2026-100700"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"nodemailer","product":"nodemailer","versions":[{"status":"affected","version":"0","lessThan":"10.0.6","versionType":"semver"},{"status":"unaffected","version":"10.0.6","versionType":"semver"}],"packageURL":"pkg:npm/nodemailer","defaultStatus":"unaffected"}],"modified":"2026-09-28T15:01:54.036Z","provider":"cve","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-v53p-9fqp-m79j","https://www.vulncheck.com/advisories/nodemailer-before-10.0.6-denial-of-service-via-addressparser"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100700","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T15:00:18.660649Z"}}}],"references":[{"url":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-v53p-9fqp-m79j","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T15:01:54.036Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:56.526Z"}}},"related_cves":[{"value":"CVE-2026-100700","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:7f27d1c8-1d75-44a5-a162-2809a326e74c","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-100700","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"nodemailer","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"10.0.6","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v53p-9fqp-m79j","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100700","advisory_id":"7f27d1c8-1d75-44a5-a162-2809a326e74c","event_types":["advisory"],"published_at":"2026-10-24T21:30:48.152375+00:00","technologies":["core-cve","nodemailer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:56.526+00:00","detail_url":"/events/3155"},"members":[{"id":3155,"cve_ids":["CVE-2026-100700"],"payload":{"kind":"advisory","title":"nodemailer before 10.0.6 Denial of Service via addressparser","summary":"nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking behavior. Attackers can supply crafted email header values with long whitespace-free runs to block the Node.js event loop for tens of seconds, causing service unavailability.","evidence":"cve:CVE-2026-100700","products":[{"name":{"value":"nodemailer","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100700","aliases":["CVE-2026-100700"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"nodemailer","product":"nodemailer","versions":[{"status":"affected","version":"0","lessThan":"10.0.6","versionType":"semver"},{"status":"unaffected","version":"10.0.6","versionType":"semver"}],"packageURL":"pkg:npm/nodemailer","defaultStatus":"unaffected"}],"modified":"2026-09-28T15:01:54.036Z","provider":"cve","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-v53p-9fqp-m79j","https://www.vulncheck.com/advisories/nodemailer-before-10.0.6-denial-of-service-via-addressparser"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100700","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T15:00:18.660649Z"}}}],"references":[{"url":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-v53p-9fqp-m79j","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T15:01:54.036Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:56.526Z"}}},"related_cves":[{"value":"CVE-2026-100700","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:7f27d1c8-1d75-44a5-a162-2809a326e74c","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-100700","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"nodemailer","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"10.0.6","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-v53p-9fqp-m79j","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100700","advisory_id":"7f27d1c8-1d75-44a5-a162-2809a326e74c","event_types":["advisory"],"published_at":"2026-10-24T21:30:48.152375+00:00","technologies":["core-cve","nodemailer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:56.526+00:00","detail_url":"/events/3155"}]}},{"id":2433,"cve_ids":["CVE-2026-100701"],"payload":{"kind":"advisory","title":"Nodemailer 5.0.0 through 10.0.1 TLS servername Cache Confusion","summary":"Nodemailer versions 5.0.0 through 10.0.1 use a process-global DNS cache that is keyed only by the DNS host, while each cache entry also stores the caller-specific TLS servername. When two direct TLS/SMTPS transports (secure: true) resolve the same non-IP host with different tls.servername values, the first transport's servername is returned on the cache hit and overwrites the second transport's explicitly configured value, so Nodemailer sends the wrong SNI value and validates the peer certificate against the wrong identity. In multi-tenant services or SNI-routed SMTP gateways, an attacker who can prime the cache can cause a victim transport to connect to the attacker's TLS virtual host and accept the attacker's certificate even with rejectUnauthorized: true, disclosing the victim's SMTP credentials. Fixed in 10.0.2.","evidence":"cve:CVE-2026-100701","products":[{"name":{"value":"nodemailer","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-100701","aliases":["CVE-2026-100701"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"nodemailer","product":"nodemailer","versions":[{"status":"affected","version":"5.0.0","lessThan":"10.0.2","versionType":"semver"},{"status":"unaffected","version":"10.0.2","versionType":"semver"}],"packageURL":"pkg:npm/nodemailer","defaultStatus":"unaffected"}],"modified":"2026-09-26T23:11:37.880Z","provider":"cve","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-6vj9-mwq6-2f5v","https://www.vulncheck.com/advisories/nodemailer-5.0.0-through-10.0.1-tls-servername-cache-confusion"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100701","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-26T23:11:29.663446Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-26T23:11:37.880Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:57.215Z"}}},"related_cves":[{"value":"CVE-2026-100701","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:bc9909b7-c5e7-42ae-9711-40d16194876e","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100701","advisory_id":"bc9909b7-c5e7-42ae-9711-40d16194876e","event_types":["advisory"],"published_at":"2026-10-24T21:18:30.755567+00:00","technologies":["core-cve","nodemailer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:57.215+00:00","detail_url":"/advisories/advisory%3Abc9909b7-c5e7-42ae-9711-40d16194876e","group":{"id":"advisory:bc9909b7-c5e7-42ae-9711-40d16194876e","revision":1,"primary_event_id":2446,"change":"published","superseded_by":[],"changed":{"id":2446,"cve_ids":["CVE-2026-100701"],"payload":{"kind":"advisory","title":"Nodemailer 5.0.0 through 10.0.1 TLS servername Cache Confusion","summary":"Nodemailer versions 5.0.0 through 10.0.1 use a process-global DNS cache that is keyed only by the DNS host, while each cache entry also stores the caller-specific TLS servername. When two direct TLS/SMTPS transports (secure: true) resolve the same non-IP host with different tls.servername values, the first transport's servername is returned on the cache hit and overwrites the second transport's explicitly configured value, so Nodemailer sends the wrong SNI value and validates the peer certificate against the wrong identity. In multi-tenant services or SNI-routed SMTP gateways, an attacker who can prime the cache can cause a victim transport to connect to the attacker's TLS virtual host and accept the attacker's certificate even with rejectUnauthorized: true, disclosing the victim's SMTP credentials. Fixed in 10.0.2.","evidence":"cve:CVE-2026-100701","products":[{"name":{"value":"nodemailer","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-100701","aliases":["CVE-2026-100701"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"nodemailer","product":"nodemailer","versions":[{"status":"affected","version":"5.0.0","lessThan":"10.0.2","versionType":"semver"},{"status":"unaffected","version":"10.0.2","versionType":"semver"}],"packageURL":"pkg:npm/nodemailer","defaultStatus":"unaffected"}],"modified":"2026-09-26T23:11:37.880Z","provider":"cve","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-6vj9-mwq6-2f5v","https://www.vulncheck.com/advisories/nodemailer-5.0.0-through-10.0.1-tls-servername-cache-confusion"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100701","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-26T23:11:29.663446Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-26T23:11:37.880Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:57.215Z"}}},"related_cves":[{"value":"CVE-2026-100701","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:bc9909b7-c5e7-42ae-9711-40d16194876e","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100701","advisory_id":"bc9909b7-c5e7-42ae-9711-40d16194876e","event_types":["advisory"],"published_at":"2026-10-24T21:18:30.755567+00:00","technologies":["core-cve","nodemailer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:57.215+00:00","detail_url":"/events/2446"},"members":[{"id":2446,"cve_ids":["CVE-2026-100701"],"payload":{"kind":"advisory","title":"Nodemailer 5.0.0 through 10.0.1 TLS servername Cache Confusion","summary":"Nodemailer versions 5.0.0 through 10.0.1 use a process-global DNS cache that is keyed only by the DNS host, while each cache entry also stores the caller-specific TLS servername. When two direct TLS/SMTPS transports (secure: true) resolve the same non-IP host with different tls.servername values, the first transport's servername is returned on the cache hit and overwrites the second transport's explicitly configured value, so Nodemailer sends the wrong SNI value and validates the peer certificate against the wrong identity. In multi-tenant services or SNI-routed SMTP gateways, an attacker who can prime the cache can cause a victim transport to connect to the attacker's TLS virtual host and accept the attacker's certificate even with rejectUnauthorized: true, disclosing the victim's SMTP credentials. Fixed in 10.0.2.","evidence":"cve:CVE-2026-100701","products":[{"name":{"value":"nodemailer","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-100701","aliases":["CVE-2026-100701"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"nodemailer","product":"nodemailer","versions":[{"status":"affected","version":"5.0.0","lessThan":"10.0.2","versionType":"semver"},{"status":"unaffected","version":"10.0.2","versionType":"semver"}],"packageURL":"pkg:npm/nodemailer","defaultStatus":"unaffected"}],"modified":"2026-09-26T23:11:37.880Z","provider":"cve","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-6vj9-mwq6-2f5v","https://www.vulncheck.com/advisories/nodemailer-5.0.0-through-10.0.1-tls-servername-cache-confusion"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100701","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-26T23:11:29.663446Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-26T23:11:37.880Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:57.215Z"}}},"related_cves":[{"value":"CVE-2026-100701","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:bc9909b7-c5e7-42ae-9711-40d16194876e","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100701","advisory_id":"bc9909b7-c5e7-42ae-9711-40d16194876e","event_types":["advisory"],"published_at":"2026-10-24T21:18:30.755567+00:00","technologies":["core-cve","nodemailer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:57.215+00:00","detail_url":"/events/2446"}]}},{"id":2432,"cve_ids":["CVE-2026-100702"],"payload":{"kind":"advisory","title":"Nodemailer before 10.0.2 Stack Exhaustion via Nested Recipient Arrays","summary":"Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, allowing attackers to cause stack exhaustion. Attackers can supply a deeply nested JSON recipient array that triggers recursive Array.toString() conversion, exhausting the call stack and terminating the Node.js process.","evidence":"cve:CVE-2026-100702","products":[{"name":{"value":"nodemailer","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100702","aliases":["CVE-2026-100702"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"nodemailer","product":"nodemailer","versions":[{"status":"affected","version":"0","lessThan":"10.0.2","versionType":"semver"},{"status":"unaffected","version":"10.0.2","versionType":"semver"}],"packageURL":"pkg:npm/nodemailer","defaultStatus":"unaffected"}],"modified":"2026-09-26T23:11:16.551Z","provider":"cve","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-8vvx-rff5-p5rq","https://www.vulncheck.com/advisories/nodemailer-before-10.0.2-stack-exhaustion-via-nested-recipient-arrays"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100702","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-26T23:11:09.180121Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-26T23:11:16.551Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:57.945Z"}}},"related_cves":[{"value":"CVE-2026-100702","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1f8b3554-5249-4132-b6c7-c01c78293d66","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100702","advisory_id":"1f8b3554-5249-4132-b6c7-c01c78293d66","event_types":["advisory"],"published_at":"2026-10-24T21:18:30.063196+00:00","technologies":["core-cve","nodemailer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:57.945+00:00","detail_url":"/advisories/advisory%3A1f8b3554-5249-4132-b6c7-c01c78293d66","group":{"id":"advisory:1f8b3554-5249-4132-b6c7-c01c78293d66","revision":1,"primary_event_id":2445,"change":"published","superseded_by":[],"changed":{"id":2445,"cve_ids":["CVE-2026-100702"],"payload":{"kind":"advisory","title":"Nodemailer before 10.0.2 Stack Exhaustion via Nested Recipient Arrays","summary":"Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, allowing attackers to cause stack exhaustion. Attackers can supply a deeply nested JSON recipient array that triggers recursive Array.toString() conversion, exhausting the call stack and terminating the Node.js process.","evidence":"cve:CVE-2026-100702","products":[{"name":{"value":"nodemailer","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100702","aliases":["CVE-2026-100702"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"nodemailer","product":"nodemailer","versions":[{"status":"affected","version":"0","lessThan":"10.0.2","versionType":"semver"},{"status":"unaffected","version":"10.0.2","versionType":"semver"}],"packageURL":"pkg:npm/nodemailer","defaultStatus":"unaffected"}],"modified":"2026-09-26T23:11:16.551Z","provider":"cve","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-8vvx-rff5-p5rq","https://www.vulncheck.com/advisories/nodemailer-before-10.0.2-stack-exhaustion-via-nested-recipient-arrays"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100702","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-26T23:11:09.180121Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-26T23:11:16.551Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:57.945Z"}}},"related_cves":[{"value":"CVE-2026-100702","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1f8b3554-5249-4132-b6c7-c01c78293d66","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100702","advisory_id":"1f8b3554-5249-4132-b6c7-c01c78293d66","event_types":["advisory"],"published_at":"2026-10-24T21:18:30.063196+00:00","technologies":["core-cve","nodemailer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:57.945+00:00","detail_url":"/events/2445"},"members":[{"id":2445,"cve_ids":["CVE-2026-100702"],"payload":{"kind":"advisory","title":"Nodemailer before 10.0.2 Stack Exhaustion via Nested Recipient Arrays","summary":"Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, allowing attackers to cause stack exhaustion. Attackers can supply a deeply nested JSON recipient array that triggers recursive Array.toString() conversion, exhausting the call stack and terminating the Node.js process.","evidence":"cve:CVE-2026-100702","products":[{"name":{"value":"nodemailer","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100702","aliases":["CVE-2026-100702"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"nodemailer","product":"nodemailer","versions":[{"status":"affected","version":"0","lessThan":"10.0.2","versionType":"semver"},{"status":"unaffected","version":"10.0.2","versionType":"semver"}],"packageURL":"pkg:npm/nodemailer","defaultStatus":"unaffected"}],"modified":"2026-09-26T23:11:16.551Z","provider":"cve","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-8vvx-rff5-p5rq","https://www.vulncheck.com/advisories/nodemailer-before-10.0.2-stack-exhaustion-via-nested-recipient-arrays"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100702","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-26T23:11:09.180121Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-26T23:11:16.551Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:57.945Z"}}},"related_cves":[{"value":"CVE-2026-100702","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1f8b3554-5249-4132-b6c7-c01c78293d66","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100702","advisory_id":"1f8b3554-5249-4132-b6c7-c01c78293d66","event_types":["advisory"],"published_at":"2026-10-24T21:18:30.063196+00:00","technologies":["core-cve","nodemailer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:57.945+00:00","detail_url":"/events/2445"}]}},{"id":1651,"cve_ids":["CVE-2026-90776"],"payload":{"kind":"advisory","title":"Nodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsing","summary":"Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms to consume excessive CPU and block the Node.js event loop for several seconds, causing denial of service.","evidence":"cve:CVE-2026-90776","products":[{"name":{"value":"nodemailer","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-90776","aliases":["CVE-2026-90776"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"nodemailer","product":"nodemailer","versions":[{"status":"affected","version":"9.1.0","lessThan":"10.0.5","versionType":"semver"},{"status":"unaffected","version":"10.0.5","versionType":"semver"}],"packageURL":"pkg:npm/nodemailer","defaultStatus":"unaffected"}],"modified":"2026-09-24T14:21:56.169Z","provider":"cve","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-prgh-xp8r-p3m5","https://github.com/nodemailer/nodemailer/commit/c07f17518d25aca8ab2ad66968dcbca538c24b89","https://github.com/nodemailer/nodemailer/blob/v10.0.4/src/addressparser/index.ts#L251","https://github.com/nodemailer/nodemailer/releases/tag/v10.0.5","https://github.com/nodemailer/nodemailer","https://www.vulncheck.com/advisories/nodemailer-9.1.0-through-10.0.4-denial-of-service-via-quadratic-address-parsing"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-90776","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-16T14:04:25.782469Z"}}}],"references":[{"url":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-prgh-xp8r-p3m5","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-16T14:04:56.860Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-24T14:21:56.169Z"}}},"related_cves":[{"value":"CVE-2026-90776","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:765a617d-ecc5-492f-91c5-2a4703074a4f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-90776","advisory_id":"765a617d-ecc5-492f-91c5-2a4703074a4f","event_types":["advisory"],"published_at":"2026-10-24T21:05:22.40159+00:00","technologies":["core-cve","nodemailer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-13T11:42:26.391+00:00","detail_url":"/advisories/advisory%3A765a617d-ecc5-492f-91c5-2a4703074a4f","group":{"id":"advisory:765a617d-ecc5-492f-91c5-2a4703074a4f","revision":1,"primary_event_id":1635,"change":"published","superseded_by":[],"changed":{"id":1635,"cve_ids":["CVE-2026-90776"],"payload":{"kind":"advisory","title":"Nodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsing","summary":"Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms to consume excessive CPU and block the Node.js event loop for several seconds, causing denial of service.","evidence":"cve:CVE-2026-90776","products":[{"name":{"value":"nodemailer","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-90776","aliases":["CVE-2026-90776"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"nodemailer","product":"nodemailer","versions":[{"status":"affected","version":"9.1.0","lessThan":"10.0.5","versionType":"semver"},{"status":"unaffected","version":"10.0.5","versionType":"semver"}],"packageURL":"pkg:npm/nodemailer","defaultStatus":"unaffected"}],"modified":"2026-09-24T14:21:56.169Z","provider":"cve","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-prgh-xp8r-p3m5","https://github.com/nodemailer/nodemailer/commit/c07f17518d25aca8ab2ad66968dcbca538c24b89","https://github.com/nodemailer/nodemailer/blob/v10.0.4/src/addressparser/index.ts#L251","https://github.com/nodemailer/nodemailer/releases/tag/v10.0.5","https://github.com/nodemailer/nodemailer","https://www.vulncheck.com/advisories/nodemailer-9.1.0-through-10.0.4-denial-of-service-via-quadratic-address-parsing"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-90776","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-16T14:04:25.782469Z"}}}],"references":[{"url":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-prgh-xp8r-p3m5","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-16T14:04:56.860Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-24T14:21:56.169Z"}}},"related_cves":[{"value":"CVE-2026-90776","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:765a617d-ecc5-492f-91c5-2a4703074a4f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-90776","advisory_id":"765a617d-ecc5-492f-91c5-2a4703074a4f","event_types":["advisory"],"published_at":"2026-10-24T21:05:22.40159+00:00","technologies":["core-cve","nodemailer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-13T11:42:26.391+00:00","detail_url":"/events/1635"},"members":[{"id":1635,"cve_ids":["CVE-2026-90776"],"payload":{"kind":"advisory","title":"Nodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsing","summary":"Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms to consume excessive CPU and block the Node.js event loop for several seconds, causing denial of service.","evidence":"cve:CVE-2026-90776","products":[{"name":{"value":"nodemailer","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-90776","aliases":["CVE-2026-90776"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"nodemailer","product":"nodemailer","versions":[{"status":"affected","version":"9.1.0","lessThan":"10.0.5","versionType":"semver"},{"status":"unaffected","version":"10.0.5","versionType":"semver"}],"packageURL":"pkg:npm/nodemailer","defaultStatus":"unaffected"}],"modified":"2026-09-24T14:21:56.169Z","provider":"cve","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-prgh-xp8r-p3m5","https://github.com/nodemailer/nodemailer/commit/c07f17518d25aca8ab2ad66968dcbca538c24b89","https://github.com/nodemailer/nodemailer/blob/v10.0.4/src/addressparser/index.ts#L251","https://github.com/nodemailer/nodemailer/releases/tag/v10.0.5","https://github.com/nodemailer/nodemailer","https://www.vulncheck.com/advisories/nodemailer-9.1.0-through-10.0.4-denial-of-service-via-quadratic-address-parsing"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-90776","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-16T14:04:25.782469Z"}}}],"references":[{"url":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-prgh-xp8r-p3m5","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-16T14:04:56.860Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-24T14:21:56.169Z"}}},"related_cves":[{"value":"CVE-2026-90776","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:765a617d-ecc5-492f-91c5-2a4703074a4f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-90776","advisory_id":"765a617d-ecc5-492f-91c5-2a4703074a4f","event_types":["advisory"],"published_at":"2026-10-24T21:05:22.40159+00:00","technologies":["core-cve","nodemailer"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-13T11:42:26.391+00:00","detail_url":"/events/1635"}]}}],"next_after":42486,"next_before":1651}