The vulnerability exists in Nodemailer 3.0.0 up to 10.0.12, where a regular expression in SMTPConnection._actionEHLO can be forced into quadratic backtracking. When an SMTP server responds to an EHLO request with a 250-AUTH line that includes a long whitespace sequence and a non‑matching token, the regex engine spends excessive time parsing the response. This blocks the Node.js event loop for seconds to hours, effectively denying service to the application while authentication is being processed. The weakness corresponds to CWE-1333.

The only vendor listed in the CVE data is Nodemailer. Versions 3.0.0 through 10.0.12 are vulnerable. Any Node.js application that imports nodemailer of these versions and establishes SMTP connections could be impacted. The issue is triggered when a malicious or man‑in‑the‑middle SMTP server sends a crafted EHLO response containing a long whitespace sequence.

The CVSS score of 8.7 indicates a high severity. The EPSS score is currently not available, but the lack of a KEV listing does not reduce the risk, as the vulnerability can be exercised by any SMTP server that the application communicates with. Attackers who can control the SMTP server or perform a man‑in‑the‑middle attack can send the crafted EHLO response to trigger the denial‑of‑service. No authentication or privileged access is required on the application side beyond establishing an SMTP connection, which is a common operation for mail sending or fetching.