A vulnerability in Nodemailer smtp-server prior to version 3.18.3 allows unauthenticated attackers to cause a denial-of-service condition.

This vulnerability affects the smtp-server component and can be triggered over the network without authentication. It enables an attacker to send specially crafted requests that result in a denial-of-service (resource exhaustion).

The CVSS score of 7.5 reflects the high risk of service interruption. For organizations relying on Nodemailer for critical mail infrastructure, this flaw could lead to significant downtime and operational failure if successfully exploited by an attacker.

Immediate Action: Update the smtp-server package to version 3.18.3 or later via your package manager.

Proactive Monitoring: Review SMTP server access logs for anomalous spikes in connection attempts or malformed request patterns that could indicate exploitation efforts.

Compensating Controls: Implement rate limiting on SMTP ingest points and ensure the server is isolated from public-facing networks unless strictly necessary.

Public Exploit Available: No confirmed public exploit exists in our curated data.

The presence of a known proof-of-concept increases the likelihood of exploitation. Organizations should prioritize updating the smtp-server dependency to version 3.18.3 immediately to eliminate the underlying vulnerability and prevent potential service disruption.