Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing

影響: npm:nodemailer >= 3.0.0, <= 10.0.9 → 10.0.10

When nodemailer DKIM-signs an outbound message, its DKIM message parser unfolds RFC 5322 header continuation lines with a loop that concatenates each continuation line onto the preceding line and then re-tests the anchored regex /^[ \t]/ against the growing merged line on every iteration. Re-testing the regex against the ever-growing accumulated line forces a full string flatten proportional to the accumulated length on each iteration, yielding O(n^2) CPU in the number of continuation lines. An…

在 GitHub Advisory Database 阅读

2026/10/23 01:07，GitHub Advisory Database 发布了“Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing”（类型：漏洞公告）。严重程度为“中危”（medium）。相关技术：JavaScript / Node.js。CVE：CVE-2026-110871。