EUVD-2026-319003

fkie_cve-2026-38728

An issue in Nodemailer smtp_server before v.3.18.3 allows a remote attacker to cause a denial of service via the SMTPStream._write, lib/smtp-stream.js components

GHSA-fv2f-rw9f-v9cm — smtp-server's command parser memory exhaustion denial-of-service

Affected: npm: smtp-server

smtp-server prior to v3.18.3 are vulnerable to unauthenticated memory exhaustion denial-of-service. smtp-server's command parser allows any remote client to consume server memory by sending data without newline characters. The server's `_remainder` buffer in `SMTPStream._write` grows without limit, leading to heap exhaustion, prolonged GC pauses that freeze the event loop, and in some cases, process crash.

The `_write` method in `lib/smtp-stream.js` appends incoming TCP chunks to `this._remainder` in command mode. The buffer is only emptied when a newline is found. If a client never sends a newline, the `_remainder` value will grow indefinitely, causing excess memory consumption.

Most recent entries from all

EUVD-2026-319003

fkie_cve-2026-38728

GHSA-fv2f-rw9f-v9cm — smtp-server's command parser memory exhaustion denial-of-service