CVE-2026-110872: 
Grafana vulnerability analysis and mitigation

CVE-2026-110872 is a quadratic complexity (O(n²)) denial-of-service vulnerability in the Nodemailer SMTP client reply parser, affecting versions 3.0.0 through 10.0.9. The flaw resides in the SMTPConnection._onData and isPartialResponse functions, where a malicious SMTP server or on-path attacker can stream continuation lines without ever sending a completion line, causing unbounded CPU consumption and memory growth before authentication. It was published on October 14, 2026, with a patch released in version 10.0.10. The vulnerability carries a CVSS v3.1 score of 5.9 (Medium) and a CVSS v4.0 score of 8.2 (High) (GitHub Advisory GHSA-4g23-2xm8-66gc, GitHub Advisory GHSA-37fc-hcrp-mmff, Red Hat Bugzilla).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption), CWE-1322 (Use of Blocking Code in Single-threaded, Non-blocking Context), and CWE-407 (Inefficient Algorithmic Complexity). In src/smtp-connection/index.ts, the _onData handler appends each SMTP continuation line to a single growing response-queue entry via this._responseQueue[len - 1] += '\n' + lines[i]. On every iteration, isPartialResponse calls /^\d+-/.test(str.slice(str.lastIndexOf('\n') + 1)), which forces a full V8 string flatten of the entire accumulated entry — a cost proportional to its current length. Over n continuation lines this yields O(n²) synchronous CPU work on Node.js's single-threaded event loop, with no cap on reply size or line count. Exploitation requires the attacker to control or impersonate the SMTP peer (malicious server, tenant-supplied host, or on-path MITM on a plaintext/pre-STARTTLS connection); no credentials are needed since the parsing occurs during the greeting and EHLO phases. A public proof-of-concept microbenchmark is included in the GitHub security advisory, demonstrating ~11.6 seconds of event-loop blocking for ~640 KB of continuation data (GitHub Advisory GHSA-4g23-2xm8-66gc).

Successful exploitation causes complete event-loop starvation of the affected Node.js process, halting all other connections, requests, and timers — not just the offending SMTP session — because Node.js is single-threaded. Memory for the accumulated response-queue entry grows without bound, leading to process crash or out-of-memory conditions. There is no confidentiality or integrity impact; the sole consequence is a sustained, remotely triggered denial of service against the sending application, reachable before any authentication occurs (GitHub Advisory GHSA-4g23-2xm8-66gc, Red Hat Bugzilla).

No public exploit kit or weaponized tool has been observed, and there is no evidence of in-the-wild exploitation as of the disclosure date. A detailed proof-of-concept (a minimal Node.js microbenchmark and attack chain description) is included in the official GitHub security advisory, lowering the bar for independent reproduction. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires the attacker to be positioned as or impersonate the SMTP server peer, which adds complexity (CVSS AC:High) (GitHub Advisory GHSA-4g23-2xm8-66gc, Feedly/EUVD).

1. Identify a target: Find a Node.js application using Nodemailer versions 3.0.0–10.0.9 that connects to an attacker-controlled or attacker-influenced SMTP server (e.g., a multi-tenant "bring your own SMTP" deployment, a deliverability probe, or a plaintext/pre-STARTTLS connection susceptible to MITM).
2. Set up a malicious TCP listener: Stand up a raw TCP server on port 25 (or the configured SMTP port) that accepts incoming SMTP connections from the Nodemailer client.
3. Stream continuation lines: Upon connection, immediately begin streaming SMTP continuation lines of the form 220-<payload>\r\n in large batches (e.g., thousands of lines), never sending a completion line such as 220 ready\r\n. This keeps the response-queue entry in a perpetual partial state.
4. Trigger quadratic parsing: Each continuation line causes _onData to append to the growing queue entry and call isPartialResponse, which flattens the entire accumulated string. With ~640 KB of continuation data (~8,000–64,000 lines), the event loop blocks for seconds to minutes, scaling quadratically.
5. Sustain the attack: Continue streaming continuation lines to maintain event-loop starvation indefinitely, as the inactivity socketTimeout resets on every inbound chunk and the greeting timeout callback is itself starved while _onData runs synchronously.
6. Observe impact: The target Node.js process becomes unresponsive — all HTTP requests, timers, and other connections handled by that process are frozen for the duration of the attack (GitHub Advisory GHSA-4g23-2xm8-66gc).

• Network: Unusual long-lived inbound TCP connections to the application's configured SMTP port from unexpected or untrusted IP addresses; SMTP sessions that never progress past the greeting/EHLO phase; high-volume streams of SMTP continuation lines (220-...) with no completion line.
• Logs: Application logs showing SMTP connection timeouts or greeting-phase hangs; Node.js process logs indicating event-loop lag or unresponsiveness; absence of SMTP authentication log entries for sessions that remain open.
• Process: Node.js process consuming abnormally high CPU (sustained near 100% on a single core) without corresponding application load; process memory growing unboundedly during an SMTP connection attempt; all application endpoints becoming unresponsive while an SMTP session is active.
• System: Out-of-memory (OOM) kills of the Node.js process; system-level alerts for memory exhaustion correlated with SMTP connection events (GitHub Advisory GHSA-4g23-2xm8-66gc).

Upgrade Nodemailer to version 10.0.10 or later, which resolves the quadratic reassembly by fixing the isPartialResponse logic and adding reply-size bounds (GitHub Advisory GHSA-4g23-2xm8-66gc). As an interim workaround, restrict Nodemailer to connect only to trusted SMTP servers over authenticated TLS, avoiding plaintext or STARTTLS-strippable connections. In multi-tenant deployments, isolate outbound SMTP sessions per tenant so a single malicious tenant-supplied host cannot starve a shared Node.js process. Network-level controls (firewall rules, allowlisting of permitted SMTP server IPs) can further reduce exposure (Red Hat Bugzilla).

The vulnerability was reported by researcher @manus-pi (GitHub) and disclosed via the official Nodemailer GitHub security advisory. Red Hat opened a Bugzilla tracking entry (Bug 2552972) with medium priority, indicating awareness across the enterprise Linux ecosystem. No significant broader media coverage or notable social media commentary has been identified beyond standard vulnerability database aggregation (GitHub Advisory GHSA-4g23-2xm8-66gc, Red Hat Bugzilla).