---
id: "GHSA-wxxx-r42m-9rp8"
kind: "vulnerability"
aliases: ["GHSA-wxxx-r42m-9rp8"]
title: "Duplicate Advisory: Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing"
severity: "high"
cvss: 6.5
epss: null
exploited: false
status: "withdrawn"
category: "package"
products: [{"name": "nodemailer", "fixed": [], "affected": ">= 3.0.0, <= 10.0.9", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["cwe-400", "email", "node.js", "nodemailer", "package", "self-hosted"]
not_affected_if: ["no-dkim-signing", "no-untrusted-header-input", "versions-below-3.0.0-or-10.0.10-plus"]
published_at: "2026-10-15T00:31:19+00:00"
first_seen_at: "2026-10-23T19:11:31+00:00"
updated_at: "2026-10-23T19:57:48+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-wxxx-r42m-9rp8", "first_seen_at": "2026-10-23T19:11:31+00:00"}]
---

# Duplicate Advisory: Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing

Nodemailer versions from 3.0.0 through 10.0.9 unfold DKIM email headers with quadratic time complexity. An attacker who can submit a message with a very long folded header or a large recipient list can block the Node.js event loop during DKIM signing, causing denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:nodemailer affected >= 3.0.0, <= 10.0.9 fixed ?

## How to check

Run `npm ls nodemailer` in the project to see the installed version; anything from 3.0.0 up to 10.0.9 is affected.
Check whether the app signs outgoing mail with DKIM and accepts untrusted header or recipient input.

## Fix

Upgrade nodemailer to 10.0.10 or later, as the original advisory states (the duplicate advisory GHSA-39m8-27wv-hr27 is the maintained record).

## Timeline

- 2026-10-23T19:11:31+00:00 ghsa https://github.com/advisories/GHSA-wxxx-r42m-9rp8

## From the sources

## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-39m8-27wv-hr27. This link is maintained to preserve external references.

## Original Description
Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers that fold into tens of thousands of continuation lines, blocking the Node.js event loop during DKIM signing.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_