Bug 2552974 (CVE-2026-110869)

Summary: CVE-2026-110869 nodemailer: nodemailer: Denial of Service via regular expression backtracking in SMTP authentication parsing
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: abarbaro, alizardo, dschmidt, ikhan, jchui, jhe, jlanda, kaycoth, kshier, ktsao, lchilton, nboldt, oaljalju, psrna, rbobbitt, rhel-process-autobot, sfeifer, simaishi, stcannon, watson-tool-maintainers, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in nodemailer. A malicious or man-in-the-middle Simple Mail Transfer Protocol (SMTP) server can cause a Denial of Service (DoS) by sending a crafted handshake response with repeated whitespace sequences during authentication mechanism detection. Inefficient regular expression processing causes excessive backtracking that blocks the application event loop, leaving the service unresponsive.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-14 23:02:40 UTC 
Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or man-in-the-middle SMTP server can reply to EHLO with 250-AUTH, a long whitespace run and a non-matching token, blocking the Node.js event loop for tens of seconds to hours before authentication.