Nodemailer, a widely used Node.js mail transport library, contains a denial‑of‑service flaw in MessageParser.parseHeaders. The bug arises from quadratic header unfolding when processing DKIM‑signed messages, allowing an attacker to supply an exceptionally large number of recipients or a header that folds into many continuation lines. When such payloads are parsed, the CPU time required grows rapidly, eventually exhausting the Node.js event loop and rendering the application unresponsive. This weakness is classified as CWE-400: Uncontrolled Resource Consumption, and it can compromise availability for any service relying on Nodemailer’s DKIM functionality.

The vulnerability affects all Nodemailer installations from version 3.0.0 up to but not including 10.0.10. Both community and commercial deployments that import the npm package nodemailer are susceptible. No impact on specific operating systems or platforms is noted; the issue is confined to the JavaScript library itself. Organisations running mail relays, notification services, or any application that uses Nodemailer for DKIM signing should assess whether they are on a protected version.

The CVSS score of 7.1 classifies this as a high‑severity vulnerability, and the lack of an available EPSS score means no quantified exploit probability is currently reported. Because the flaw requires an attacker to send crafted mail to the target application, it is limited to environments that accept inbound mail or process arbitrary DKIM mail. The vulnerability is not listed in CISA’s KEV catalog, indicating no known large‑scale exploitation has been reported to date. The most probable attack vector involves forging a DKIM‑signed message with many recipients or folded header lines, causing the target service to allocate excessive CPU cycles and stall.