{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "nodemailer: important CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/nodemailer--nodemailer/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/nodemailer--nodemailer/important.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-110869/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-110869/",
   "title": "CVE-2026-110869 · nodemailer · disclosed",
   "content_text": "Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or man-in-the-middle SMTP server can reply to EHLO with 250-AUTH, a long whitespace run and a non-matching token, blocking the Node.js event loop for tens of seconds to hours before authentication.",
   "date_published": "2026-10-14T22:52:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-110869/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-110869/",
   "title": "CVE-2026-110869 · nodemailer · fixed in Debian 14 (node-nodemailer 10.0.13+~8.0.2-1)",
   "content_text": "Fixed versions: node-nodemailer 10.0.13+~8.0.2-1.",
   "date_published": "2026-10-14T22:52:57Z"
  }
 ]
}