High severity7.5NVD Advisory· Published May 15, 2026· Updated Jun 17, 2026

CVE-2026-38728

Description

An issue in Nodemailer smtp_server before v.3.18.3 allows a remote attacker to cause a denial of service via the SMTPStream._write, lib/smtp-stream.js components

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
smtp-servernpm	< 3.18.3	3.18.3

Affected products

Nodemailer/SMTP Serverreferences2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <3.18.3

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-fv2f-rw9f-v9cmghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2026-38728ghsaADVISORY
bytecreator.dev/blog/CVE-2026-38728nvdWEB
github.com/nodemailer/smtp-server/commit/592c5666fa0c76d1d04c1a32abad0ef806fbfe97ghsaWEB
github.com/nodemailer/smtp-server/releases/tag/v3.18.3nvdWEB

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000