{"id":"ghsa-ghsa-4g23-2xm8-66gc","seq":1708813,"kind":"advisory","title":"Nodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of service","url":"https://github.com/advisories/GHSA-4g23-2xm8-66gc","permalink":"https://vulnpulse.app/items/ghsa-ghsa-4g23-2xm8-66gc","summary":"影響: npm:nodemailer >= 3.0.0, <= 10.0.9 → 10.0.10\nThe SMTP client response parser reassembles multiline server replies by appending each continuation line onto a single response-queue entry and re-testing whether that entry is still a partial (continuation) reply on every line. The partial-response test runs str.slice(str.lastIndexOf('\\n') + 1) on the growing entry, which forces a full flatten of the entire accumulated string on each line. A malicious or compromised SMTP server (or an on-path attacker on a plaintext or pre-STARTTLS hop) that s…","severity":"medium","techs":["nodejs"],"cves":[],"tags":["GHSA-4g23-2xm8-66gc","nodemailer"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-27T15:04:33.000Z","fetched_at":"2026-10-27T21:03:52.214Z"}