CVE-2026-110871 Nodemailer 3.0.0 before 10.0.10 Quadratic DKIM Header Unfolding Denial of Service
Attackers can cause denial of service by exhausting CPU resources through quadratic header unfolding in Nodemailer's DKIM signing process.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-110871?
CVE-2026-110871 is a high-severity denial of service vulnerability in nodemailer, published on 14 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers that fold into tens of thousands of continuation lines, blocking the Node.js event loop during DKIM signing.
Weakness: CWE-400
Which versions are affected by CVE-2026-110871?
2 open source packages ship an affected version, including nodemailer.
| Package | Affected | Fixed in |
|---|---|---|
nodemailer npm | From 3.0.0 | 10.0.10 |
nodemailer npm | From 3.0.0 | 10.0.10 |
How do I fix CVE-2026-110871?
Upgrade nodemailer to 10.0.10 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-110871 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-110871 exists.
Sources
Also known as CLSA-2026-1792486237, CLSA-2026-1792495264, CLSA-2026-1792505981, CLSA-2026-1792509085, CLSA-2026-1792518061, CLSA-2026-1792524218 and 5 more.