{"id":"ghsa-ghsa-39m8-27wv-hr27","seq":309586,"kind":"advisory","title":"Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing","url":"https://github.com/advisories/GHSA-39m8-27wv-hr27","permalink":"https://vulnpulse.app/items/ghsa-ghsa-39m8-27wv-hr27","summary":"影響: npm:nodemailer >= 3.0.0, <= 10.0.9 → 10.0.10\nWhen nodemailer DKIM-signs an outbound message, its DKIM message parser unfolds RFC 5322 header continuation lines with a loop that concatenates each continuation line onto the preceding line and then re-tests the anchored regex /^[ \\t]/ against the growing merged line on every iteration. Re-testing the regex against the ever-growing accumulated line forces a full string flatten proportional to the accumulated length on each iteration, yielding O(n^2) CPU in the number of continuation lines. An…","severity":"medium","techs":["nodejs"],"cves":["CVE-2026-110871"],"tags":["GHSA-39m8-27wv-hr27","nodemailer"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-22T16:07:04.000Z","fetched_at":"2026-10-22T20:09:55.169Z"}