CVE-2026-110869
Description
A flaw was found in nodemailer. A malicious or man-in-the-middle Simple Mail Transfer Protocol (SMTP) server can cause a Denial of Service (DoS) by sending a crafted handshake response with repeated whitespace sequences during authentication mechanism detection. Inefficient regular expression processing causes excessive backtracking that blocks the application event loop, leaving the service unresponsive.
Statement
A denial of service flaw of Important severity (Red Hat CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) was found in nodemailer, a Node.js SMTP client library that several Red Hat products bundle as a dependency. When nodemailer's SMTP client processes a server's EHLO response to detect supported authentication mechanisms, four regular expressions containing overlapping whitespace sub-patterns can backtrack quadratically. A malicious or man-in-the-middle SMTP server can reply to EHLO with a 250-AUTH line containing a long run of whitespace followed by a non-matching token, causing excessive regular expression backtracking that blocks the Node.js event loop for tens of seconds to hours before authentication even occurs, leaving the application or service unresponsive. Confidentiality and integrity are not affected; only availability is impacted.
Red Hat products that bundle affected nodemailer versions are impacted, including Red Hat Enterprise Linux 10 (grafana), Red Hat In-Vehicle OS (grafana), Red Hat Developer Hub (rhdh-hub-rhel9), Red Hat Ansible Automation Platform (bootc-automation-portal-rhel9), and cloud.redhat.com (backoffice-proxy). For these products a fix is being pursued through the responsible product teams under delegated resolution. The Red Hat Hardened Images (Hummingbird) grafana image entries have been resolved as not affected because the vulnerable component is not present in the shipped images.
Red Hat rates this flaw as Important, consistent with the upstream view of a network-accessible, availability-only impact; the upstream CVSS 4.0 score of 8.7 versus the Red Hat CVSS 3.1 score of 7.5 reflects a difference in scoring methodology rather than a different assessment of the vulnerability.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream fix is available in nodemailer 10.0.13 and later; updates for affected Red Hat products that bundle nodemailer are being pursued through the respective product teams.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU)
Attackers can create crafted inputs that intentionally cause the regular expression to use excessive backtracking in a way that causes the CPU consumption to spike.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
