{"action":"Upgrade smtp-server to 3.18.3 or later.","affected":[{"fixed":"3.18.3","introduced":"0"}],"component":"smtp-server","cve_ids":["CVE-2026-38728"],"ecosystem":"npm","epss":0.00572,"exploited":false,"fixed_versions":["3.18.3"],"ghsa_id":"GHSA-fv2f-rw9f-v9cm","id":"tcs_01M5KFP8KSX2NNVQDG061EZ9D8","modified_at":"2026-06-29T23:26:32.795552Z","published_at":"2026-05-15T15:30:45Z","references":["https://osv.dev/vulnerability/GHSA-fv2f-rw9f-v9cm","https://nvd.nist.gov/vuln/detail/CVE-2026-38728","https://github.com/nodemailer/smtp-server/commit/592c5666fa0c76d1d04c1a32abad0ef806fbfe97","https://bytecreator.dev/blog/CVE-2026-38728","https://github.com/nodemailer/smtp-server","https://github.com/nodemailer/smtp-server/releases/tag/v3.18.3"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-fv2f-rw9f-v9cm","url":"https://osv.dev/vulnerability/GHSA-fv2f-rw9f-v9cm"},{"source":"nvd","source_id":"CVE-2026-38728","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-38728"}],"summary":"smtp-server's command parser memory exhaustion denial-of-service"}