GHSA-4g23-2xm8-66gc - Nodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of service

## Summary The SMTP client response parser reassembles multiline server replies by appending each continuation line onto a single response-queue entry and re-testing whether that entry is still a partial (continuation) reply on every line. The partial-response test runs `str.slice(str.lastIndexOf('\n') + 1)` on the growing entry, which forces a full flatten of the entire accumulated string on each line. A malicious or compromised SMTP server (or an on-path attacker on a plaintext or pre-STARTTLS hop) that streams continuation lines and never sends a completion line drives O(n^2) CPU on the single-threaded Node.js event loop before any authentication, freezing the whole process for an attacker-controlled duration. ## Root Cause The invariant that a server cannot cause superlinear client-side work while a reply is being reassembled is violated. In `src/smtp-connection/index.ts`, `_onData` splits inbound bytes into lines and, while the last queued entry is a continuation reply, concatenates each new line onto that same entry with `this._responseQueue[len - 1] += '\n' + lines[i]`. On every iteration it calls `isPartialResponse(lastline)`, which evaluates `/^\d+-/.test(str.slice(str.lastIndexOf('\n') + 1))`. Because the queued entry grows by one line per continuation line and is stored as a V8 rope (ConsString), each `lastIndexOf`/`slice` forces a full string flatten of length proportional to the accumulated reply. Executed once per line over n continuation lines, this is O(n^2) CPU. While the reply stays partial the function early-returns and never resets the entry, so the growth and the per-line reflatten continue unbounded. There is no response-size or line-count cap in the connection code; the only limits are time-based (`greetingTimeout`, and an inactivity `socketTimeout`), and neither bounds accumulated reply size. ```text Affected file and functions (verified at the published v10.0.9 artifact, in src/ and in the built dist/cjs and dist/esm output): - src/smtp-