The vulnerability is a quadratic‑time denial‑of‑service flaw in Nodemailer’s SMTP reply parser. A malicious or compromised SMTP server can send a large number of uncompleted continuation lines before the client authenticates, forcing the Node.js event loop to process thousands of lines and exhausting memory. If the server does not send a terminating line, the client’s data handling routine remains blocked, causing the entire application to become unresponsive or crash. The flaw belongs to the resource exhaustion weakness class.

The issue affects Nodemailer versions from 3.0.0 up to, but not including10. All deployments that use these older Nodemailer releases, regardless of operating system, are potentially vulnerable. The vulnerability is triggered when the application connects to any SMTP server that can be controlled or observed by an attacker.

With a CVSS score of 8.2 the severity is high. Because the exploit requires only network access to an SMTP endpoint, it can be performed by remote attackers without needing privileged credentials. The EPSS score is unavailable, so the current probability of exploitation is unclear, yet the impact of exhausting process memory makes it a serious concern. The vulnerability is not listed in the CISA KEV catalog today, but its remote nature and high impact warrant immediate attention and mitigation.