Nodemailer

Nodemailer Security Releases - October 2026

nodemailer-2026-10 Oct 1, 2026 Source: Vendor

Nodemailer security advisories for October 2026, compiled from CVE.org records.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://www.cve.org/CVERecord?id=CVE-2026-110869

Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

6 lines

Showing 1–6 of 6

CVE-2026-110869 BR2026-0000-031437 nodemailer unclaimed

Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns tha...

Credited as manus-pi

CVE-2026-110869 BR2026-0000-031438 nodemailer unclaimed

Credited as manus-use

CVE-2026-110870 BR2026-0000-031439 nodemailer unclaimed

Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can su...

Credited as StarPlatinu

CVE-2026-110871 BR2026-0000-031440 nodemailer unclaimed

Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supp...

Credited as manus-pi

CVE-2026-110871 BR2026-0000-031441 nodemailer unclaimed

Credited as manus-use

CVE-2026-110872 BR2026-0000-031442 nodemailer unclaimed

Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection._onData and isPartialResponse. A malicious SMT...

Credited as manus-use