Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in…
Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection._onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before authentication, blocking the Node.js event loop and exhausting memory.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Node.js
- Product
- Node.js
- CVSS
- 5.9
- Exposure class
- Developer platform
Why it ranks 8 (Routine)
- CVSS 5.9 medium
- Product class: developer platform
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.