CVE-2026-110871: 
Grafana vulnerability analysis and mitigation

CVE-2026-110871 is a denial-of-service vulnerability in Nodemailer caused by quadratic (O(n²)) CPU complexity during DKIM header unfolding in MessageParser.parseHeaders. It affects Nodemailer versions 3.0.0 through 10.0.9 (fixed in 10.0.10) and was disclosed on October 14–15, 2026. An authenticated (low-privilege) network attacker can supply large recipient lists or long folded headers to exhaust CPU and block the Node.js event loop during DKIM signing. It carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 7.1 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is an inefficient header-unfolding algorithm in src/dkim/message-parser.ts (CWE-400: Uncontrolled Resource Consumption; CWE-1322: Use of Blocking Code in Single-threaded, Non-blocking Context). The parseHeaders() function iterates backward over split header lines and, for each RFC 5322 continuation line matching /^[ \t]/, appends it to the preceding line via += and then re-tests the anchored regex against the ever-growing merged string on the next iteration. This forces a full string flatten proportional to the accumulated length on each pass, yielding O(n²) CPU cost relative to the number of continuation lines. No header-block size or line-count cap exists between input and the sink — the signer's MAX_MESSAGE_SIZE and cacheTreshold knobs apply only to the body stream, not the header block — so an attacker-controlled header (e.g., a large To: recipient list that Nodemailer's MIME composer folds at column 76) can drive tens of thousands of continuation lines (GitHub Advisory).

Successful exploitation blocks the single-threaded Node.js event loop synchronously during DKIM signing, halting all other work in the process for an attacker-scaled duration — measured at approximately 2.8 seconds at 20,000 continuation lines, 11.5 seconds at 40,000, and 6.6 seconds with a 60,000-recipient To: header. The attack is repeatable on every such message, making it a sustained denial-of-service primitive against any application that DKIM-signs outbound mail and accepts user-influenced header content. There is no confidentiality or integrity impact; the sole consequence is availability loss to the affected Node.js process (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date; the Feedly data shows no exploited-at entries and no PoC listings. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires only low privileges (e.g., the ability to submit an email with a large recipient list or long header to a DKIM-signing application), making it accessible to any authenticated user of a vulnerable bulk-mail, notification, or multi-tenant email API (GitHub Advisory, Red Hat Bugzilla).

1. Identify a target: Locate an application that uses Nodemailer 3.0.0–10.0.9 with DKIM signing enabled (a common deliverability configuration) and accepts user-supplied recipient lists or custom headers.
2. Craft a large folded header: Construct an email with a very large To: or Cc: recipient list (e.g., tens of thousands of addresses), or a long Subject, References, or custom header value. Nodemailer's MIME composer automatically folds these at column 76 into space-prefixed RFC 5322 continuation lines.
3. Submit the message: Send the crafted message through the application's email submission interface (API endpoint, form, etc.) with any valid low-privilege account.
4. Trigger the quadratic loop: When Nodemailer DKIM-signs the message, MessageParser.parseHeaders() processes the folded header block, re-testing the growing merged line against /^[ \t]/ on each iteration, causing O(n²) CPU consumption.
5. Achieve event-loop starvation: The synchronous unfold loop blocks the Node.js event loop for seconds to tens of seconds (scaling quadratically with continuation-line count), denying service to all other requests handled by the process. Repeat per message for sustained impact (GitHub Advisory).

• Logs: Node.js application logs showing unusually long request processing times or timeouts during email send operations; event loop lag metrics spiking to seconds during DKIM signing.
• Process: Node.js process CPU usage pegged at 100% on a single core for multi-second intervals correlated with email submission events; absence of other process activity during the stall.
• Application Behavior: Email API endpoints becoming unresponsive or timing out repeatedly; queued email jobs stalling without error during the signing phase.
• Network: Repeated submissions of emails with abnormally large To:, Cc:, or other header fields from the same source IP or authenticated user account (GitHub Advisory).

Upgrade Nodemailer to version 10.0.10 or later, which addresses the quadratic unfolding behavior. As an interim workaround, applications should enforce strict caps on recipient counts and header-value sizes for any messages that will be DKIM-signed, preventing the continuation-line count from reaching problematic levels. Additionally, rate-limiting email submission endpoints and validating input header sizes at the application layer can reduce exposure until patching is complete (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was reported by researcher @manus-pi (GitHub) and published as a moderate-severity advisory by Nodemailer maintainer andris9 on September 30, 2026. Red Hat tracked it via their Security Response process (Bugzilla bug 2552965) with medium priority and severity. No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability database aggregation (GitHub Advisory, Red Hat Bugzilla).