# Nodemailer quadratic DKIM header unfolding denial of service

Source: https://junglewise.ai/threats/duplicate-advisory-nodemailer-quadratic-o-n-2-dkim-header-unfolding-a2b86ca5  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-15. Updated: 2026-10-22  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 6.5 · Published 2026-10-15

Nodemailer is a Node.js email library used to send messages with cryptographic signing. An attacker can craft messages with large folded headers (such as many recipients) that force the email signing process to consume excessive CPU and block the application from processing other requests, causing a denial of service.

Technologies: [Nodemailer](https://junglewise.ai/threats/technologies/nodemailer), [nodemailer (npm)](https://junglewise.ai/threats/technologies/npm-nodemailer). Vendors: [Nodemailer](https://junglewise.ai/threats/vendors/nodemailer), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 6.5, published 15 October 2026.

**Which products and versions are affected?** Nodemailer 3.0.0 through 10.0.9; nodemailer (npm) >= 3.0.0, <= 10.0.9, SEMVER:introduced=3.0.0,last_affected=10.0.9.

**Is there a fix for This vulnerability?** Yes: fixed in 10.0.10. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run Nodemailer or nodemailer (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 10.0.10

## Technical details

The MessageParser.parseHeaders function in src/dkim/message-parser.ts unfolds RFC 5322 header continuation lines with quadratic complexity: it concatenates continuation lines in a loop and re-tests an anchored regex against the growing merged line on each iteration, forcing a full string flatten proportional to accumulated length. An attacker who controls message headers (especially large recipient lists) can force tens of thousands of continuation lines and block the single-threaded Node.js event loop for seconds during DKIM signing.

## Affected products

- Nodemailer Nodemailer 3.0.0 through 10.0.9

## Timeline

- 2026-09-30: disclosed
- 2026-10-14: advisory
- 2026-10-15: patched

## References

- [https://github.com/nodemailer/nodemailer/security/advisories/GHSA-39m8-27wv-hr27](https://github.com/nodemailer/nodemailer/security/advisories/GHSA-39m8-27wv-hr27)

## Related threats

- [Nodemailer address parsing bypass in addressparser](https://junglewise.ai/threats/cve-2026-125755-nodemailer-3-0-0-before-10-4-1-contains-an-address-parsing-flaw)
- [Nodemailer address parsing bypass in nested RFC 5322 comments](https://junglewise.ai/threats/cve-2026-121424-nodemailer-from-3-0-0-before-10-1-4-contains-an-address-parsing)
- [Nodemailer addressparser RFC 5322 comment parsing bypass](https://junglewise.ai/threats/nodemailer-a-nested-comment-ends-early-in-addressparser-releasing-the-4e80613c)
- [Nodemailer addressparser group terminator bypass in quoted strings](https://junglewise.ai/threats/nodemailer-a-inside-a-quoted-string-or-comment-ends-an-address-group-b8b045f9)
- [Nodemailer addressparser angle-addr parsing bypass](https://junglewise.ai/threats/nodemailer-a-inside-a-quoted-local-part-ends-an-angle-addr-early-in-28663cfb)