HighFix available
node-nodemailer — security advisory
Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers that fold into tens of thousands of continuation lines, blocking the Node.js event loop during DKIM signing.
- Products
- node-nodemailer
- Affected versions
- 10.0.0+~8.0.1-1, 10.0.10+~8.0.1-1, 10.0.10+~8.0.2-1, 10.0.13+~8.0.2-1, 10.0.14+~8.0.2-1, 10.1.7+~8.0.2-1, 6.10.0+~6.4.17-1, 6.10.0+~6.4.17-1+deb13u1, 6.8.0+~6.4.6-1, 6.9.13+~6.4.14-1, 6.9.15+~6.4.16-1, 6.9.16+~6.4.16-1, 6.9.4+~6.4.9-1, 6.9.4+~6.4.9-2, 6.9.4+~6.4.9-3, 6.9.4+~6.4.9-4, 7.0.10+~7.0.2-1, 7.0.12+~7.0.5-1, 7.0.5+~7.0.1-1, 7.0.6+~7.0.1-1, 7.0.9+~7.0.2-1, 7.0.9+~7.0.2-2, 8.0.11+~8.0.1-1, 8.0.2+~7.0.11-1, 8.0.3+~7.0.11-1, 8.0.4+~7.0.11-1, 8.0.4+~7.0.11-2, 9.0.0+~8.0.1-1, 9.0.3+~8.0.1-1, 9.0.5+~8.0.1-1, 9.0.6+~8.0.1-1
- Fixed versions
- 10.0.10+~8.0.1-1
- CVEs
- CVE-2026-110871
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 02:05 UTC · Revision 1
Source evidence
Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers that fold into tens of thousands of continuation lines, blocking the Node.js event loop during DKIM signing.
osv:DEBIAN-CVE-2026-110871
node-nodemailer
Fixed versions: Not specified
node-nodemailer
Fixed versions: Not specified
node-nodemailer
Fixed versions: 10.0.10+~8.0.1-1
Complete source record
{
"id": "c97a1a9b90b600c00b7b95878bee3676f34dbf365428c847bc030e70819761e1",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2026-110871",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2026-110871",
"summary": "Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers that fold into tens of thousands of continuation lines, blocking the Node.js event loop during DKIM signing.",
"evidence": "osv:DEBIAN-CVE-2026-110871",
"products": [
{
"name": {
"value": "node-nodemailer",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "10.0.0+~8.0.1-1",
"evidence": "/affected/0/versions"
},
{
"value": "10.0.10+~8.0.1-1",
"evidence": "/affected/0/versions"
},
{
"value": "10.0.10+~8.0.2-1",
"evidence": "/affected/0/versions"
},
{
"value": "10.0.13+~8.0.2-1",
"evidence": "/affected/0/versions"
},
{
"value": "10.0.14+~8.0.2-1",
"evidence": "/affected/0/versions"
},
{
"value": "10.1.7+~8.0.2-1",
"evidence": "/affected/0/versions"
},
{
"value": "6.10.0+~6.4.17-1",
"evidence": "/affected/0/versions"
},
{
"value": "6.8.0+~6.4.6-1",
"evidence": "/affected/0/versions"
},
{
"value": "6.9.13+~6.4.14-1",
"evidence": "/affected/0/versions"
},
{
"value": "6.9.15+~6.4.16-1",
"evidence": "/affected/0/versions"
},
{
"value": "6.9.16+~6.4.16-1",
"evidence": "/affected/0/versions"
},
{
"value": "6.9.4+~6.4.9-1",
"evidence": "/affected/0/versions"
},
{
"value": "6.9.4+~6.4.9-2",
"evidence": "/affected/0/versions"
},
{
"value": "6.9.4+~6.4.9-3",
"evidence": "/affected/0/versions"
},
{
"value": "6.9.4+~6.4.9-4",
"evidence": "/affected/0/versions"
},
{
"value": "7.0.10+~7.0.2-1",
"evidence": "/affected/0/versions"
},
{
"value": "7.0.12+~7.0.5-1",
"evidence": "/affected/0/versions"
},
{
"value": "7.0.5+~7.0.1-1",
"evidence": "/affected/0/versions"
},
{
"value": "7.0.6+~7.0.1-1",
"evidence": "/affected/0/versions"
},
{
"value": "7.0.9+~7.0.2-1",
"evidence": "/affected/0/versions"
},
{
"value": "7.0.9+~7.0.2-2",
"evidence": "/affected/0/versions"
},
{
"value": "8.0.11+~8.0.1-1",
"evidence": "/affected/0/versions"
},
{
"value": "8.0.2+~7.0.11-1",
"evidence": "/affected/0/versions"
},
{
"value": "8.0.3+~7.0.11-1",
"evidence": "/affected/0/versions"
},
{
"value": "8.0.4+~7.0.11-1",
"evidence": "/affected/0/versions"
},
{
"value": "8.0.4+~7.0.11-2",
"evidence": "/affected/0/versions"
},
{
"value": "9.0.0+~8.0.1-1",
"evidence": "/affected/0/versions"
},
{
"value": "9.0.3+~8.0.1-1",
"evidence": "/affected/0/versions"
},
{
"value": "9.0.5+~8.0.1-1",
"evidence": "/affected/0/versions"
},
{
"value": "9.0.6+~8.0.1-1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "node-nodemailer",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "10.0.0+~8.0.1-1",
"evidence": "/affected/1/versions"
},
{
"value": "10.0.10+~8.0.1-1",
"evidence": "/affected/1/versions"
},
{
"value": "10.0.10+~8.0.2-1",
"evidence": "/affected/1/versions"
},
{
"value": "10.0.13+~8.0.2-1",
"evidence": "/affected/1/versions"
},
{
"value": "10.0.14+~8.0.2-1",
"evidence": "/affected/1/versions"
},
{
"value": "10.1.7+~8.0.2-1",
"evidence": "/affected/1/versions"
},
{
"value": "6.10.0+~6.4.17-1",
"evidence": "/affected/1/versions"
},
{
"value": "6.10.0+~6.4.17-1+deb13u1",
"evidence": "/affected/1/versions"
},
{
"value": "7.0.10+~7.0.2-1",
"evidence": "/affected/1/versions"
},
{
"value": "7.0.12+~7.0.5-1",
"evidence": "/affected/1/versions"
},
{
"value": "7.0.5+~7.0.1-1",
"evidence": "/affected/1/versions"
},
{
"value": "7.0.6+~7.0.1-1",
"evidence": "/affected/1/versions"
},
{
"value": "7.0.9+~7.0.2-1",
"evidence": "/affected/1/versions"
},
{
"value": "7.0.9+~7.0.2-2",
"evidence": "/affected/1/versions"
},
{
"value": "8.0.11+~8.0.1-1",
"evidence": "/affected/1/versions"
},
{
"value": "8.0.2+~7.0.11-1",
"evidence": "/affected/1/versions"
},
{
"value": "8.0.3+~7.0.11-1",
"evidence": "/affected/1/versions"
},
{
"value": "8.0.4+~7.0.11-1",
"evidence": "/affected/1/versions"
},
{
"value": "8.0.4+~7.0.11-2",
"evidence": "/affected/1/versions"
},
{
"value": "9.0.0+~8.0.1-1",
"evidence": "/affected/1/versions"
},
{
"value": "9.0.3+~8.0.1-1",
"evidence": "/affected/1/versions"
},
{
"value": "9.0.5+~8.0.1-1",
"evidence": "/affected/1/versions"
},
{
"value": "9.0.6+~8.0.1-1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "node-nodemailer",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "10.0.10+~8.0.1-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": [
{
"value": "10.0.0+~8.0.1-1",
"evidence": "/affected/2/versions"
},
{
"value": "6.10.0+~6.4.17-1",
"evidence": "/affected/2/versions"
},
{
"value": "7.0.10+~7.0.2-1",
"evidence": "/affected/2/versions"
},
{
"value": "7.0.12+~7.0.5-1",
"evidence": "/affected/2/versions"
},
{
"value": "7.0.5+~7.0.1-1",
"evidence": "/affected/2/versions"
},
{
"value": "7.0.6+~7.0.1-1",
"evidence": "/affected/2/versions"
},
{
"value": "7.0.9+~7.0.2-1",
"evidence": "/affected/2/versions"
},
{
"value": "7.0.9+~7.0.2-2",
"evidence": "/affected/2/versions"
},
{
"value": "8.0.11+~8.0.1-1",
"evidence": "/affected/2/versions"
},
{
"value": "8.0.2+~7.0.11-1",
"evidence": "/affected/2/versions"
},
{
"value": "8.0.3+~7.0.11-1",
"evidence": "/affected/2/versions"
},
{
"value": "8.0.4+~7.0.11-1",
"evidence": "/affected/2/versions"
},
{
"value": "8.0.4+~7.0.11-2",
"evidence": "/affected/2/versions"
},
{
"value": "9.0.0+~8.0.1-1",
"evidence": "/affected/2/versions"
},
{
"value": "9.0.3+~8.0.1-1",
"evidence": "/affected/2/versions"
},
{
"value": "9.0.5+~8.0.1-1",
"evidence": "/affected/2/versions"
},
{
"value": "9.0.6+~8.0.1-1",
"evidence": "/affected/2/versions"
}
]
}
],
"severity": "high",
"structured": {
"id": "DEBIAN-CVE-2026-110871",
"aliases": [
"DEBIAN-CVE-2026-110871"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "node-nodemailer",
"purl": "pkg:deb/debian/node-nodemailer?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"10.0.0+~8.0.1-1",
"10.0.10+~8.0.1-1",
"10.0.10+~8.0.2-1",
"10.0.13+~8.0.2-1",
"10.0.14+~8.0.2-1",
"10.1.7+~8.0.2-1",
"6.10.0+~6.4.17-1",
"6.8.0+~6.4.6-1",
"6.9.13+~6.4.14-1",
"6.9.15+~6.4.16-1",
"6.9.16+~6.4.16-1",
"6.9.4+~6.4.9-1",
"6.9.4+~6.4.9-2",
"6.9.4+~6.4.9-3",
"6.9.4+~6.4.9-4",
"7.0.10+~7.0.2-1",
"7.0.12+~7.0.5-1",
"7.0.5+~7.0.1-1",
"7.0.6+~7.0.1-1",
"7.0.9+~7.0.2-1",
"7.0.9+~7.0.2-2",
"8.0.11+~8.0.1-1",
"8.0.2+~7.0.11-1",
"8.0.3+~7.0.11-1",
"8.0.4+~7.0.11-1",
"8.0.4+~7.0.11-2",
"9.0.0+~8.0.1-1",
"9.0.3+~8.0.1-1",
"9.0.5+~8.0.1-1",
"9.0.6+~8.0.1-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-110871.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "node-nodemailer",
"purl": "pkg:deb/debian/node-nodemailer?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"10.0.0+~8.0.1-1",
"10.0.10+~8.0.1-1",
"10.0.10+~8.0.2-1",
"10.0.13+~8.0.2-1",
"10.0.14+~8.0.2-1",
"10.1.7+~8.0.2-1",
"6.10.0+~6.4.17-1",
"6.10.0+~6.4.17-1+deb13u1",
"7.0.10+~7.0.2-1",
"7.0.12+~7.0.5-1",
"7.0.5+~7.0.1-1",
"7.0.6+~7.0.1-1",
"7.0.9+~7.0.2-1",
"7.0.9+~7.0.2-2",
"8.0.11+~8.0.1-1",
"8.0.2+~7.0.11-1",
"8.0.3+~7.0.11-1",
"8.0.4+~7.0.11-1",
"8.0.4+~7.0.11-2",
"9.0.0+~8.0.1-1",
"9.0.3+~8.0.1-1",
"9.0.5+~8.0.1-1",
"9.0.6+~8.0.1-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-110871.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "10.0.10+~8.0.1-1"
}
]
}
],
"package": {
"name": "node-nodemailer",
"purl": "pkg:deb/debian/node-nodemailer?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"10.0.0+~8.0.1-1",
"6.10.0+~6.4.17-1",
"7.0.10+~7.0.2-1",
"7.0.12+~7.0.5-1",
"7.0.5+~7.0.1-1",
"7.0.6+~7.0.1-1",
"7.0.9+~7.0.2-1",
"7.0.9+~7.0.2-2",
"8.0.11+~8.0.1-1",
"8.0.2+~7.0.11-1",
"8.0.3+~7.0.11-1",
"8.0.4+~7.0.11-1",
"8.0.4+~7.0.11-2",
"9.0.0+~8.0.1-1",
"9.0.3+~8.0.1-1",
"9.0.5+~8.0.1-1",
"9.0.6+~8.0.1-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-110871.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-23T18:05:31.895035849Z",
"provider": "osv",
"upstream": [
"CVE-2026-110871"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2026-110871"
]
},
"related_cves": [
{
"value": "CVE-2026-110871",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 424472,
"published_at": "2026-10-14T23:17:28.953+00:00"
}