CVE-2026-110871

What it actually does

Quadratic header unfolding in MessageParser.parseHeaders causes excessive CPU consumption when processing messages with large recipient lists or headers containing tens of thousands of folded continuation lines, blocking the Node.js event loop during DKIM signing.

Why it matters to the business

Email sending services become unresponsive or unavailable under load from crafted messages, disrupting automated notifications, transactional mail, and outbound communication workflows.

How an attack unfolds

An attacker crafts an email containing either an extremely long recipient list or header fields with many continuation lines, submits it through the application using Nodemailer, and triggers the vulnerable parsing path during DKIM signing, exhausting CPU resources and stalling the event loop.

How to fix it

Upgrade Nodemailer to version 10.0.10 or later; if immediate upgrade is not possible, implement input validation or rate limiting on recipient counts and header sizes before passing data to Nodemailer.

How to confirm the fix worked

Confirm the installed Nodemailer version is at least 10.0.10; test with synthetic messages containing large folded headers or recipient lists and verify that CPU usage remains bounded and the event loop does not stall.

Typical attack path

1. Identify an application endpoint that accepts email recipient lists or custom headers and uses Nodemailer for delivery.
2. Submit a message with either thousands of recipients or a header containing tens of thousands of folded continuation lines.
3. Trigger DKIM signing so that MessageParser.parseHeaders is invoked.
4. Observe sustained high CPU usage and blocked event loop that prevents further email processing.

How to detect it

Search Node.js application logs and process monitors for sustained high CPU usage on email-handling threads immediately after inbound message processing; correlate with unusually large recipient counts or header sizes in mail submission logs.

What your security team should do

• Prioritize upgrade of Nodemailer to 10.0.10+ across all services within the next 30 days given the recent publication and rising EPSS trend.
• Add application-level validation to cap recipient list size and header line counts before invoking Nodemailer.
• Monitor Node.js process CPU and event-loop latency metrics for sudden spikes correlated with email sending activity.
• Review and harden any public-facing email submission endpoints that feed into Nodemailer.