{"id":"GHSA-wxxx-r42m-9rp8","kind":"vulnerability","aliases":["GHSA-wxxx-r42m-9rp8"],"related":[],"title":"Duplicate Advisory: Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-39m8-27wv-hr27. This link is maintained to preserve external references.\n\n## Original Description\nNodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers that fold into tens of thousands of continuation lines, blocking the Node.js event loop during DKIM signing.","summary":"Nodemailer versions from 3.0.0 through 10.0.9 unfold DKIM email headers with quadratic time complexity. An attacker who can submit a message with a very long folded header or a large recipient list can block the Node.js event loop during DKIM signing, causing denial of service.","severity":"high","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"nodemailer","fixed":[],"affected":">= 3.0.0, <= 10.0.9","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-400","email","node.js","nodemailer","package","self-hosted"],"not_affected_if":["no-dkim-signing","no-untrusted-header-input","versions-below-3.0.0-or-10.0.10-plus"],"how_to_check":"Run `npm ls nodemailer` in the project to see the installed version; anything from 3.0.0 up to 10.0.9 is affected.\nCheck whether the app signs outgoing mail with DKIM and accepts untrusted header or recipient input.","fix":"Upgrade nodemailer to 10.0.10 or later, as the original advisory states (the duplicate advisory GHSA-39m8-27wv-hr27 is the maintained record).","status":"withdrawn","published_at":"2026-10-15T00:31:19+00:00","first_seen_at":"2026-10-23T19:11:31+00:00","triaged_at":"2026-10-23T19:57:48+00:00","updated_at":"2026-10-23T19:57:48+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T19:57:48Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade nodemailer to 10.0.10 or later, as the original advisory states (the duplicate advisory GHSA-39m8-27wv-hr27 is the maintained record).\nunknown","summary":"Nodemailer versions from 3.0.0 through 10.0.9 unfold DKIM email headers with quadratic time complexity. An attacker who can submit a message with a very long folded header or a large recipient list can block the Node.js event loop during DKIM signing, causing denial of service.","category":"package","who_cares":["nodemailer","node.js","self-hosted","email"],"confidence":0.8,"analyst_note":"","how_to_check":"Run `npm ls nodemailer` in the project to see the installed version; anything from 3.0.0 up to 10.0.9 is affected.\nCheck whether the app signs outgoing mail with DKIM and accepts untrusted header or recipient input.","needs_analyst":false,"not_affected_if":["versions-below-3.0.0-or-10.0.10-plus","no-dkim-signing","no-untrusted-header-input"],"severity_if_unknown":"high"},"cost_usd":0.000412,"input_tokens":2187,"output_tokens":386,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-400':35B '10.0.10':120C '10.0.9':48B '2':7A '27wv':104C '3.0.0':46B,118C '39m8':103C '9rp8':27A,32A 'advisori':2A,89C,91C 'allow':130C 'attack':58B,139C 'block':76B,157C 'caus':16A,84B 'complex':56B 'contain':121C 'continu':155C 'cpu':134C 'cwe':34B 'denial':18A,85B,123C 'descript':115C 'dkim':8A,50B,82B,163C 'duplic':1A,88C,99C 'email':36B,51B 'event':79B,160C 'exhaust':133C 'extern':112C 'fold':14A,68B,149C 'ghsa':24A,29A,102C 'ghsa-39m8-27wv-hr27':101C 'ghsa-wxxx-r42m-9rp8':23A,28A 'header':9A,15A,52B,69B,137C,147C 'host':42B 'hr27':105C 'larg':13A,72B,142C 'let':11A 'line':156C 'link':107C 'list':74B,144C 'long':67B,146C 'loop':80B,161C 'maintain':109C 'messag':63B 'messageparser.parseheaders':128C 'n':6A 'node.js':37B,78B,159C 'nodemail':3A,38B,43B,116C 'nodemailer':33A 'o':5A 'origin':114C 'packag':39B 'preserv':111C 'quadrat':4A,54B,136C 'r42m':26A,31A 'recipi':73B,143C 'refer':113C 'remot':17A 'self':41B 'self-host':40B 'servic':20A,87B,125C 'sign':22A,83B,164C 'submit':61B 'suppli':141C 'ten':151C 'thousand':153C 'time':55B 'unfold':10A,49B,138C 'user':131C 'version':44B 'vulner':126C 'withdrawn':94C 'wxxx':25A,30A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-15T00:31:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-wxxx-r42m-9rp8","url":"https://github.com/advisories/GHSA-wxxx-r42m-9rp8","severity":"high","published_at":"2026-10-15T00:31:19+00:00","modified_at":"2026-10-22T16:06:04+00:00","first_seen_at":"2026-10-23T19:11:31+00:00","fetched_at":"2026-10-23T19:11:31+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}