CVE-2026-110869: 
Grafana vulnerability analysis and mitigation

CVE-2026-110869 is a Regular Expression Denial of Service (ReDoS) vulnerability in Nodemailer's SMTP client, specifically in the SMTPConnection._actionEHLO function. It affects Nodemailer versions 3.0.0 through 10.0.12 (npm package), and was disclosed on October 14–15, 2026. A malicious or man-in-the-middle SMTP server can craft a specially formed EHLO response that triggers quadratic backtracking in four AUTH mechanism detection regexes, blocking the Node.js event loop for tens of seconds to hours. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory GHSA-4ffr-jq9g-5ffx, GitHub Advisory Database, Red Hat Bugzilla).

The root cause is CWE-1333 (Inefficient Regular Expression Complexity). Four regular expressions in SMTPConnection._actionEHLO (located in src/smtp-connection/index.ts, lines 2162, 2167, 2172, 2177) each contain the sub-pattern (?:(\s+|=)[^\n]*\s+|\s+|=) before the mechanism literal (PLAIN, LOGIN, CRAM-MD5, XOAUTH2). The [^\n]* and trailing \s+ both match whitespace and can consume the same characters, so when the mechanism literal is absent, the regex engine must try every partition of the whitespace run before failing — producing O(n²) backtracking. These four regexes run unconditionally on every EHLO response with no length cap, shape validation, or early rejection, and the only existing guard (maxResponseSize at 1 MB) does not prevent the attack since a 4,000-character whitespace run (0.4% of the cap) already blocks each regex for tens of seconds (GitHub Advisory GHSA-4ffr-jq9g-5ffx).

Successful exploitation causes a pure availability impact — confidentiality and integrity are unaffected. Because Node.js is single-threaded, blocking the event loop with catastrophic regex backtracking suspends all other work in the process: no requests are served, no timers fire, and the built-in 10-minute socket timeout cannot interrupt a synchronous test() call. A single malicious EHLO response can render the entire Node.js application unresponsive for tens of seconds to hours, affecting any service that relies on Nodemailer for outbound email (GitHub Advisory GHSA-4ffr-jq9g-5ffx, GitHub Advisory Database).

No public proof-of-concept exploit code has been released and there is no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, and the vulnerability is not listed in the CISA KEV catalog. However, the advisory includes a self-contained PoC script (requiring no live SMTP server) that demonstrates the O(n²) timing behavior by running the four regexes against a synthesized crafted line. Two realistic attacker positions exist: a multi-tenant mailer where tenants configure their own SMTP server, and any network-adjacent attacker capable of intercepting a cleartext SMTP session before STARTTLS negotiation — both require no authentication to the target SMTP server (GitHub Advisory GHSA-4ffr-jq9g-5ffx, Feedly).

1. Identify a target: Find a Node.js application using Nodemailer 3.0.0–10.0.12 for outbound SMTP. This includes multi-tenant SaaS platforms where users can configure their own SMTP server, or any application sending mail over a network path accessible to the attacker.
2. Establish attacker-controlled SMTP server: Either operate a malicious SMTP server that the victim application connects to (e.g., by being a tenant on a multi-tenant platform), or perform a man-in-the-middle attack on a cleartext SMTP connection before STARTTLS negotiation.
3. Craft malicious EHLO response: When the victim's Nodemailer client sends an EHLO command, respond with a crafted 250-AUTH continuation line containing a long whitespace run followed by a non-matching token, e.g.: 250-AUTH + ' ' * N + NOMATCH (where N ≥ ~4,000 characters for tens-of-seconds blocking).
4. Trigger quadratic backtracking: The four AUTH mechanism detection regexes in _actionEHLO each attempt to match PLAIN, LOGIN, CRAM-MD5, and XOAUTH2 against the crafted line. Each regex enters catastrophic backtracking due to the overlapping [^\n]* and \s+ sub-patterns, blocking the Node.js event loop.
5. Achieve denial of service: The Node.js process stalls entirely for the duration of the regex evaluations (tens of seconds to hours depending on whitespace length), rendering the application unresponsive to all requests and timers (GitHub Advisory GHSA-4ffr-jq9g-5ffx).

• Network: Outbound SMTP connections from the application server to unexpected or tenant-configured SMTP hosts; SMTP sessions that remain open for an unusually long duration without completing authentication.
• Logs: Application logs showing SMTP connections that hang or time out during the EHLO/capability negotiation phase (before authentication); Node.js process logs indicating event loop stalls or unresponsiveness.
• Process: Node.js process consuming 100% CPU on a single core for an extended period (tens of seconds to hours) without completing any work; health check endpoints becoming unresponsive while the process is still running.
• SMTP Traffic: EHLO responses from the peer SMTP server containing 250-AUTH lines with abnormally long whitespace sequences (thousands of space characters) followed by unrecognized tokens (GitHub Advisory GHSA-4ffr-jq9g-5ffx).

Update Nodemailer to version 10.0.13 or later, which replaces the four backtracking regexes with a non-ambiguous, linear-time parse of the AUTH extension (GitHub Advisory GHSA-4ffr-jq9g-5ffx). As interim mitigations for environments where upgrading is not immediately possible: restrict SMTP connections to a known allowlist of trusted servers via network segmentation; implement application-level timeouts to interrupt unresponsive SMTP connections; and for multi-tenant platforms, validate or restrict user-supplied SMTP server endpoints. Note that restricting to trusted SMTP peers does not protect against network-adjacent MITM attackers on cleartext SMTP paths (Feedly).

The vulnerability was reported by researcher @manus-pi (GitHub) and published as a detailed security advisory by the Nodemailer maintainer (andris9) on September 30, 2026, with CVE assignment and public disclosure following on October 14–15, 2026. Red Hat tracked the issue via Bugzilla with a high severity rating, and VulnCheck published an advisory. No significant broader media coverage or notable social media discussion has been identified at this time (GitHub Advisory GHSA-4ffr-jq9g-5ffx, Red Hat Bugzilla).