## Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing

- 種別: advisory
- 重大度: medium
- 関連技術: nodejs
- CVE: CVE-2026-110871
- 公開日時: 2026-10-22T16:07:04.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-39m8-27wv-hr27)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-39m8-27wv-hr27

影響: npm:nodemailer >= 3.0.0, <= 10.0.9 → 10.0.10
When nodemailer DKIM-signs an outbound message, its DKIM message parser unfolds RFC 5322 header continuation lines with a loop that concatenates each continuation line onto the preceding line and then re-tests the anchored regex /^[ \t]/ against the growing merged line on every iteration. Re-testing the regex against the ever-growing accumulated line forces a full string flatten proportional to the accumulated length on each iteration, yielding O(n^2) CPU in the number of continuation lines. An…