# CVE-2026-110869: Nodemailer regular expression denial of service in SMTP AUTH detection

Source: https://junglewise.ai/threats/cve-2026-110869-nodemailer-3-0-0-before-10-0-13-has-a-regular-expression-denial  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-14. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-110869 · Severity: high · CVSS 7.5 · Published 2026-10-14

Nodemailer is a Node.js library that sends emails via SMTP servers. Versions 3.0.0 through 10.0.12 contain a flaw in how they parse SMTP server responses during the authentication handshake. An attacker controlling or intercepting the SMTP connection can craft a malicious response that causes the Node.js application to freeze for tens of seconds to hours, blocking all other work. No credentials are needed to mount the attack, making it a serious denial of service threat for any application sending emails through attacker-influenced servers.

Technologies: [Nodemailer](https://junglewise.ai/threats/technologies/nodemailer), [nodemailer (npm)](https://junglewise.ai/threats/technologies/npm-nodemailer). Vendors: [Nodemailer](https://junglewise.ai/threats/vendors/nodemailer), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-110869 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-110869 being exploited in the wild.

**How severe is CVE-2026-110869?** High severity, with a CVSS score of 7.5, published 14 October 2026.

**Which products and versions are affected?** Nodemailer 3.0.0 to 10.0.12; nodemailer (npm) SEMVER:introduced=3.0.0,fixed=10.0.13.

**Is there a fix for CVE-2026-110869?** Yes. nodemailer (npm): upgrade to 10.0.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-110869 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-110869?** Check whether you run Nodemailer or nodemailer (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- nodemailer (npm): upgrade to 10.0.13 or later

  ```sh
  npm install nodemailer@10.0.13
  ```


## Technical details

The vulnerability is a quadratic backtracking regex denial of service (ReDoS) in SMTPConnection._actionEHLO. Four overlapping regular expressions used to detect SASL AUTH mechanisms contain ambiguous whitespace-matching sub-patterns that cause the regex engine to try exponential combinations when a mechanism name is absent. A pre-authentication remote attacker can send an EHLO response with "250-AUTH" followed by a long whitespace run (up to 1 MB) and a non-matching token, causing the synchronous regex execution to block the Node.js event loop entirely.

## Affected products

- nodemailer Nodemailer 3.0.0 to 10.0.12

## Identifiers

- CVE-2026-110869
- GHSA-4ffr-jq9g-5ffx

## Timeline

- 2026-09-30: disclosed
- 2026-10-14: advisory

## References

- [https://github.com/nodemailer/nodemailer/security/advisories/GHSA-4ffr-jq9g-5ffx](https://github.com/nodemailer/nodemailer/security/advisories/GHSA-4ffr-jq9g-5ffx)
- [https://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.0.13-redos-via-smtp-auth-mechanism-detection-regexes](https://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.0.13-redos-via-smtp-auth-mechanism-detection-regexes)

## Related threats

- [Nodemailer address parsing bypass in addressparser](https://junglewise.ai/threats/cve-2026-125755-nodemailer-3-0-0-before-10-4-1-contains-an-address-parsing-flaw)
- [Nodemailer address parsing bypass in nested RFC 5322 comments](https://junglewise.ai/threats/cve-2026-121424-nodemailer-from-3-0-0-before-10-1-4-contains-an-address-parsing)
- [Nodemailer addressparser RFC 5322 comment parsing bypass](https://junglewise.ai/threats/nodemailer-a-nested-comment-ends-early-in-addressparser-releasing-the-4e80613c)
- [Nodemailer addressparser group terminator bypass in quoted strings](https://junglewise.ai/threats/nodemailer-a-inside-a-quoted-string-or-comment-ends-an-address-group-b8b045f9)
- [Nodemailer addressparser angle-addr parsing bypass](https://junglewise.ai/threats/nodemailer-a-inside-a-quoted-local-part-ends-an-angle-addr-early-in-28663cfb)