CVE-2026-38728: Nodemailer SMTP Server DoS Vulnerability

CVE-2026-38728 Overview

CVE-2026-38728 is a denial-of-service vulnerability in the Nodemailer smtp-server package before version 3.18.3. The flaw resides in the SMTPStream._write function inside lib/smtp-stream.js. A remote attacker can send crafted SMTP traffic that causes uncontrolled resource consumption [CWE-400], exhausting the host process and rendering the mail server unavailable. The issue is exploitable over the network without authentication or user interaction. The vulnerability affects availability only and does not expose confidentiality or integrity. The maintainers addressed the issue in smtp-server v3.18.3.

Critical Impact

Unauthenticated remote attackers can crash or hang Nodemailer smtp-server instances by abusing the SMTPStream._write parser, disrupting mail delivery for all connected clients.

Affected Products

• Nodemailer smtp-server versions prior to v3.18.3
• Applications embedding the smtp-server Node.js module for inbound SMTP processing
• Mail relays and gateways built on Nodemailer's SMTP server library

Discovery Timeline

• 2026-05-15 - CVE-2026-38728 published to NVD
• 2026-05-18 - Last updated in NVD database

Technical Details for CVE-2026-38728

Vulnerability Analysis

The defect lies in SMTPStream._write, the writable-stream handler that parses inbound SMTP bytes inside lib/smtp-stream.js. The function processes attacker-controlled input from the TCP connection without sufficient bounds or pacing controls. An attacker can submit SMTP traffic shaped to trigger excessive CPU work or unbounded buffering inside the stream parser. The resulting resource exhaustion causes the Node.js event loop to stall or the process to terminate. Because SMTP listeners are typically network-exposed on port 25, 465, or 587, exploitation requires only the ability to open a TCP socket. The flaw is classified under [CWE-400] Uncontrolled Resource Consumption.

Root Cause

The root cause is insufficient input validation and resource accounting inside the _write chunk handler. The parser does not enforce strict limits on the work performed per inbound chunk before yielding back to the event loop. Malformed or pathological SMTP framing forces the function into expensive code paths that scale with attacker input.

Attack Vector

Exploitation is remote and unauthenticated. An attacker connects to the exposed SMTP listener and sends crafted bytes that drive SMTPStream._write into the vulnerable code path. No SMTP authentication, TLS client certificate, or prior session state is required. A single malicious connection can degrade service, and repeated connections can keep the server unreachable. Refer to the GitHub SMTP Server Release v3.18.3 notes and the ByteCreator Blog CVE-2026-38728 writeup for additional context.

Detection Methods for CVE-2026-38728

Indicators of Compromise

• Repeated SMTP connections from a small set of source IPs followed by abrupt session termination or server unresponsiveness.
• Node.js process restarts, out-of-memory kills, or CPU saturation correlated with inbound SMTP traffic.
• SMTP transactions that never reach the MAIL FROM or DATA stages yet consume sustained CPU on the server process.

Detection Strategies

• Monitor the smtp-server package version across deployments and flag any instance running a release earlier than v3.18.3.
• Track per-connection byte volume, command rate, and connection duration to identify clients sending malformed or oversized SMTP payloads.
• Alert on Node.js worker crashes or systemd restarts of mail services that coincide with external SMTP traffic spikes.

Monitoring Recommendations

• Ship SMTP access logs, process supervisor events, and host CPU and memory metrics to a centralized analytics platform for correlation.
• Baseline normal SMTP command sequences and alert on deviations such as unusually long lines, missing CRLF terminators, or stalled DATA phases.
• Enable network flow logging on SMTP ports to retain source-IP evidence for post-incident review.

How to Mitigate CVE-2026-38728

Immediate Actions Required

• Upgrade the smtp-server dependency to v3.18.3 or later across all Nodemailer-based mail services.
• Audit package.json and package-lock.json files in production builds to confirm the patched version is resolved and deployed.
• Restrict inbound SMTP exposure to required networks until the upgrade is verified in production.

Patch Information

The fix is included in smtp-server v3.18.3, published by the Nodemailer project. Review the GitHub SMTP Server Release v3.18.3 page and the GitHub SMTP Server Repository commit history for the specific changes to lib/smtp-stream.js. Rebuild and redeploy any container images, serverless bundles, or platform packages that vendor the vulnerable version.

Workarounds

• Place a hardened reverse proxy or SMTP-aware gateway in front of the Nodemailer listener to enforce line length, command rate, and idle timeouts.
• Apply firewall or cloud security group rules to limit inbound SMTP connections to known mail relays.
• Configure the host process supervisor to automatically restart the SMTP worker on crash to reduce outage duration while patching is in progress.

# Configuration example
npm install smtp-server@^3.18.3
npm ls smtp-server