CVE-2026-38728
1 advisory.
npm/smtp-server CVE-2026-38728: high
smtp-server's command parser memory exhaustion denial-of-service
Action: Upgrade smtp-server to 3.18.3 or later.
npm i smtp-server@3.18.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.18.3 | - |
Fixed versions
| 3.18.3 |
Sources
- osv: GHSA-fv2f-rw9f-v9cm
- https://nvd.nist.gov/vuln/detail/CVE-2026-38728
- https://github.com/nodemailer/smtp-server/commit/592c5666fa0c76d1d04c1a32abad0ef806fbfe97
- https://bytecreator.dev/blog/CVE-2026-38728
- https://github.com/nodemailer/smtp-server
- https://github.com/nodemailer/smtp-server/releases/tag/v3.18.3
CVE-2026-38728 · published · modified · JSON