AIKIDO-2026-810392

TL;DR

Nodemailer's SMTP client builds a multiline server reply by appending each continuation line to a single queued string and rescanning that whole string with lastIndexOf and slice on every new line. The string grows with each line, so the rescan cost grows with the accumulated reply and CPU time becomes quadratic. A malicious or on path SMTP server that streams continuation lines without ever completing the reply blocks the Node.js event loop before the client authenticates. The fix tracks partial reply state separately so each line is checked once and caps the buffered reply size.