Live › vulnerability › GHSA-wxxx-r42m-9rp8
Go to dashboardNodemailer versions from 3.0.0 through 10.0.9 unfold DKIM email headers with quadratic time complexity. An attacker who can submit a message with a very long folded header or a large recipient list can block the Node.js event loop during DKIM signing, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| nodemailer | npm | >= 3.0.0, <= 10.0.9 | – |
Run npm ls nodemailer in the project to see the installed version; anything from 3.0.0 up to 10.0.9 is affected.
Check whether the app signs outgoing mail with DKIM and accepts untrusted header or recipient input.
Upgrade nodemailer to 10.0.10 or later, as the original advisory states (the duplicate advisory GHSA-39m8-27wv-hr27 is the maintained record).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
This advisory has been withdrawn because it is a duplicate of GHSA-39m8-27wv-hr27. This link is maintained to preserve external references.
Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers that fold into tens of thousands of continuation lines, blocking the Node.js event loop during DKIM signing.
This page as .md · .json · in your agent: get_signal("GHSA-wxxx-r42m-9rp8")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.