{"id":"ghsa-ghsa-4ffr-jq9g-5ffx","seq":1708811,"kind":"advisory","title":"Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service","url":"https://github.com/advisories/GHSA-4ffr-jq9g-5ffx","permalink":"https://vulnpulse.app/items/ghsa-ghsa-4ffr-jq9g-5ffx","summary":"影響: npm:nodemailer >= 3.0.0, <= 10.0.12 → 10.0.13\nNodemailer's SMTP client applies four regular expressions to a peer's EHLO response to detect the supported SASL mechanisms. Each pattern uses an alternation with two overlapping whitespace-matching sub-patterns, which produces quadratic (O(n^2)) backtracking whenever the mechanism name is absent from the line. A malicious or MITM SMTP server that answers EHLO with 250-AUTH followed by a long whitespace-only run and a non-matching token blocks the Node.js event loop for tens of seconds to hours…","severity":"medium","techs":["nodejs"],"cves":[],"tags":["GHSA-4ffr-jq9g-5ffx","nodemailer"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-27T15:04:39.000Z","fetched_at":"2026-10-27T21:03:52.214Z"}