Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
26 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Nodemailer's SMTP client applies four regular expressions to a peer's EHLO response to detect the supported SASL mechanisms. Each pattern uses an alternation with two overlapping whitespace-matching sub-patterns, which produces quadratic (O(n^2)) backtracking whenever the mechanism name is absent from the line. A malicious or MITM SMTP server that answers EHLO with `250-AUTH` followed by a long whitespace-only run and a non-matching token blocks the Node.js event loop for tens of seconds to hours during a pre-authentication handshake. No authentication to the target SMTP server is required, and any application that connects to an attacker-influenced host is affected. Root Cause Each of the four AUTH mechanism regexes in `SMTPConnection._actionEHLO` contains the sub-pattern `(?:(\s+|=)[^\n]*\s+|\s+|=)` before the mechanism literal. `[^\n]*` and the trailing `\s+` both match whitespace and can consume the same characters, so when the mechanism literal is absent, the regex…
Recommended action: Upgrade to 10.0.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Nodemailer's address parser has three published, patched fixes for RFC 5322 comment `( ... )` handling inside an addr-spec: GHSA-cc9r-2j5m-2m83 (comment glued two domain atoms into one), GHSA-g57g-f23g-4646 (the same glue for a quoted local part), and the related ReDoS fixes GHSA-prgh-xp8r-p3m5 / GHSA-v53p-9fqp-m79j. All three fixes live in `_handleAddress()`'s `joins` / `_recoverAddrSpec()` logic in `src/addressparser/index.ts`, and that logic is exercised whenever the local text-accumulation path in the tokenizer runs. That logic is never reached at all for the single most common way a recipient is written: a display name followed by an angle-bracket address, `Name `. When the input inside the angle brackets itself contains an RFC 5322 comment, e.g. ``` Legit User ``` the comment is not recognized as an operator, is not stripped, and the parenthesis characters survive verbatim inside the parsed address. That value is used as-is for `envelope.to` and is written…
Recommended action: Upgrade to 10.0.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The SMTP client response parser reassembles multiline server replies by appending each continuation line onto a single response-queue entry and re-testing whether that entry is still a partial (continuation) reply on every line. The partial-response test runs `str.slice(str.lastIndexOf('\n') + 1)` on the growing entry, which forces a full flatten of the entire accumulated string on each line. A malicious or compromised SMTP server (or an on-path attacker on a plaintext or pre-STARTTLS hop) that streams continuation lines and never sends a completion line drives O(n^2) CPU on the single-threaded Node.js event loop before any authentication, freezing the whole process for an attacker-controlled duration. Root Cause The invariant that a server cannot cause superlinear client-side work while a reply is being reassembled is violated. In `src/smtp-connection/index.ts`, `_onData` splits inbound bytes into lines and, while the last queued entry is a continuation reply,…
Recommended action: Upgrade to 10.0.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vulnerability summary RFC 5322 comments nest. addressparser ended a comment at the first `)`, including the one that closes a nested comment, and parsed the rest of the outer comment as header text. `Victim (x(y) ) ` names `v@victim.com` with `x(y) ` as a comment, and Nodemailer read it as the address `evil@evil.com`. This is the same shape as the escaped parenthesis fixed in 10.1.2, reached through nesting instead of a quoted-pair. Affected: 3.0.0 through 10.1.3. Attacker capabilities The attacker controls the text of an address that an application passes to Nodemailer, or the From or To header of an inbound message parsed with mailparser. No access to the application, its configuration or its credentials is needed. The value is a syntactically valid RFC 5322 address that conformant parsers accept without defects. Realistic exploitation scenario An application validates a submitted address with a conformant parser and allows only its own domain. The attacker submits…
Recommended action: Upgrade to 10.1.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vulnerability summary addressparser ends an RFC 5322 group at the first `;`, including one inside a quoted display name or a comment. The text after it is parsed again as top level recipients with the quoting flipped, so text that every conformant parser reads as a display name or comment becomes a live address. `G: (a; ) ;` names only `v@victim.com`, and Nodemailer read it as the single recipient `evil@evil.com`. Affected: 3.0.0 through 10.1.3. Attacker capabilities The attacker controls the text of an address field that an application passes to Nodemailer, or the header of an inbound message parsed with mailparser. No access to the application, its configuration or its credentials is needed. The value is a syntactically valid RFC 5322 group that conformant parsers accept without defects. Realistic exploitation scenario An application validates the recipients of a submitted address list with a conformant parser and only allows addresses at its own domain. The attacker…
Recommended action: Upgrade to 10.1.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vulnerability summary addressparser ends an angle-addr at the first `>` it sees, including one inside a quoted local part, a comment or a domain literal. The domain is then read off the text in front of that `>`. ` "@good.com>` is the mailbox `"a@evil.com>"@good.com` under RFC 5322, and Nodemailer read it as an address at `evil.com`. The unbracketed spelling of the same value was already read correctly. Affected: 3.0.0 through 10.1.3. Attacker capabilities The attacker controls the text of a recipient or sender address that an application passes to Nodemailer, for example a To value entered in a contact or invite form, or the header of an inbound message parsed with mailparser. No access to the application, its configuration or its credentials is needed. The value is a syntactically valid RFC 5322 address that conformant parsers accept without defects. Realistic exploitation scenario An application lets users send invitations or notifications only to addresses at an…
Recommended action: Upgrade to 10.1.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When nodemailer DKIM-signs an outbound message, its DKIM message parser unfolds RFC 5322 header continuation lines with a loop that concatenates each continuation line onto the preceding line and then re-tests the anchored regex /^[ \t]/ against the growing merged line on every iteration. Re-testing the regex against the ever-growing accumulated line forces a full string flatten proportional to the accumulated length on each iteration, yielding O(n^2) CPU in the number of continuation lines. An application user who influences the size of a header that folds into many continuation lines (most naturally a large recipient list, but also a long custom header, Subject, or References) can drive tens of thousands of continuation lines and block the single-threaded Node.js event loop for seconds during signing, a repeatable denial of service. Root Cause The invariant that signing a message performs work linear in the message size is violated in the header-unfolding step. In…
Recommended action: Upgrade to 10.0.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
nodemailer/lib/addressparser parses one shape of address in O(n^2) time. A single ~640 KB address value blocks the Node.js event loop for roughly 7 seconds. And it is reachable without auth: mailparser feeds inbound email headers straight into this parser, so one crafted email is enough to stall a service that parses mail. Details The parser builds a single address by accumulating its atoms into one string. When the atoms are separated by RFC 5322 comments, like a@b(c)@b(c)@b(c)..., every atom re-joins that same growing string. The join check in src/addressparser/index.ts: The issue is the order of the last two operands. parts[parts.length - 1].slice(-1) runs before the cheap token.value.charAt(0). slice(-1) has to flatten the accumulator to read its last character → O(current length) → and that runs on every token → O(n^2) over the whole value. Since || is left to right, the cheap charAt(0) that would short-circuit never gets the chance. The chain: long comment-joined…
Recommended action: Upgrade to 10.0.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Nodemailer's address parser can produce an unexpected recipient address when an RFC 5322 comment follows the domain of an address whose local-part is a quoted string. For example: is parsed as: The resulting address therefore contains additional attacker-controlled domain text separated by a literal space. The parsed .address value is subsequently propagated into the SMTP envelope: The envelope construction uses the parsed address without another strict address validation step. This appears to be a variant of the RFC 5322 comment parsing issue addressed by GHSA-cc9r-2j5m-2m83, but it follows a different parser path when the local-part is quoted. Reproduction Input: Observed parser output: A second example: produces: For comparison, the corresponding unquoted form: takes a different code path and is handled by the existing protection differently. Technical Details The issue is caused by different parsing behavior for quoted and unquoted local-parts. The quoted-local-part…
Recommended action: Upgrade to 10.0.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When addressparser finds no address by its strict reading, it falls back to pulling one out of the free text with /\s\b[^@\s]+@[^\s]+\b\s/. That pattern backtracks quadratically: [^@\s]+ is retried from every offset and rescans the run to the next @ each time. A single header value holding a long whitespace-free run with no usable @ blocks the Node.js event loop for tens of seconds. It is cheaper to exploit than GHSA-prgh-xp8r-p3m5: 273KB is enough for ~43s, where the comment-joined shape needed ~1.5MB for ~10s. Details The fallback in src/addressparser/index.ts ran the pattern as a search. [^@\s]+ crosses neither whitespace nor @, so from each start offset it scans forward to the next @ or to the end of the run and then fails, and the engine simply advances one character and repeats. Three shapes make every offset fail: - the run holds no @ at all - the only @ has nothing after it - the only @ has nothing before it A fourth reaches it with a valid address present but placed…
Recommended action: Upgrade to 10.0.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Submission metadata | Field | Value | |---|---| | Ecosystem | npm | | Package | nodemailer | | Repository | https://github.com/nodemailer/nodemailer | | Tested commit | 40d52215aac65b811d7e131bc916f68605efd9d2 | | Current tested version | 10.0.1 | | Confirmed vulnerable versions | 2.7.2, 3.0.0, 7.0.11, 9.1.1, 10.0.1 | | Proposed affected range | = 2.7.2, <= 10.0.1 | | Patched version | 10.0.2 | Summary Nodemailer 10.0.1 does not safely process deeply nested arrays supplied through recipient fields such as to, cc, and bcc. The public MimeNodeAddressInput type recursively permits arrays, but MimeNode.parseAddresses() flattens only the outermost array. A remaining nested array is passed to addressparser(), whose Tokenizer coerces the input with .toString(). Native Array.prototype.toString() recursively processes every nested array through join() and toString() until the V8 call stack is exhausted. A valid 10,021-byte JSON recipient value containing one address wrapped in 5,000 arrays…
Recommended action: Upgrade to 10.0.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Nodemailer's process-global DNS cache is keyed only by host, but each cache entry also stores the caller-specific TLS servername. When two direct SMTPS transports use the same DNS host with different tls.servername values, the first transport's server name is returned to the second transport and overwrites its explicitly configured value. As a result, Nodemailer sends the wrong SNI value and verifies the peer certificate against the wrong identity. In a multi-tenant service or SNI-routed SMTP gateway, one tenant can prime the cache so that a victim transport connects to the attacker's TLS virtual host, accepts the attacker's certificate with rejectUnauthorized: true, and sends the victim's SMTP credentials to it. Affected component - Ecosystem: npm - Package: nodemailer - Repository: https://github.com/nodemailer/nodemailer - Tested version: 10.0.1 - Tested commit: 40d52215aac65b811d7e131bc916f68605efd9d2 - Runtime-confirmed vulnerable versions: 5.0.0 and 10.0.1 - Affected…
Recommended action: Upgrade to 10.0.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Nodemailer resolves an international (IDN / non-ASCII) recipient domain to a different Punycode xn-- label than every UTS‑46‑conformant parser (web browsers, the WHATWG URL Standard, Node's url.domainToASCII, Python's idna). Its address normalizer (normalizeAddress in lib/mime-node/index.js) uses the bundled raw RFC‑3492 Punycode codec with no UTS‑46 mapping/normalization, so a domain that a standards‑compliant validator maps to a trusted domain is delivered by Nodemailer to a different, attacker‑registrable domain. An application that applies a domain allow‑list / same‑domain check to a recipient using a normal IDN‑aware parser (or that shows the normalized recipient to a user for confirmation) and then relies on Nodemailer to deliver to that domain can be induced to send email to an unintended external domain. This is the same weakness class as CVE‑2025‑13033 (Interpretation Conflict, CWE‑436) but reached through IDN/Punycode rather than quoted local‑parts, and it is not…
Recommended action: Upgrade to 9.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Nodemailer's address parser (lib/addressparser/index.js) parses a list of comma‑separated addresses in quadratic time — O(n²) in the number of addresses. A single crafted address string (e.g. a To, Cc, Bcc, From, or Reply‑To value, or any value passed to the exported addressparser) therefore consumes CPU proportional to the square of its length and blocks Node's single‑threaded event loop for the entire duration, denying service to every other request in the process. This requires no special application configuration and no cooperating receiver — it is entirely inside the parser and triggers on the library's default code path. A ~1.5 MB address value freezes the process for ~25–30 seconds of 100% CPU; the cost grows with the square of the input, so a few‑MB value stalls the server for minutes. It is a distinct issue from the recursion DoS fixed as CVE‑2025‑14874 (that path is guarded by a nesting‑depth cap; this one is a flat, comma‑separated list with no such limit). Details…
Recommended action: Upgrade to 9.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Nodemailer's email-address parser treats an RFC 5322 comment ( ... ) inside the domain as a point to concatenate the surrounding text, rather than as folding whitespace (CFWS) that terminates the domain. Consequently a recipient address such as user@good-corp.com(x)evil.com is parsed and delivered to good-corp.comevil.com (registrable domain comevil.com, attacker‑controlled), while a conformant RFC 5322 parser terminates the domain at the comment and reads good-corp.com. An application that decides whether it is allowed to email a recipient by parsing/validating the recipient's domain — with a strict RFC 5322 parser (used without inspecting parse defects) or with a naive prefix/substring allow‑list — and then hands the raw address to Nodemailer for delivery, can be induced to send mail to a domain the attacker controls. This is an Interpretation Conflict (CWE‑436), the same class as CVE‑2025‑13033, reached through the RFC 5322 comment construct (the "Comments" technique in…
Recommended action: Upgrade to 9.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Nodemailer's disableFileAccess / disableUrlAccess options are a security sandbox that lets an application forbid untrusted message content (html/text/attachment path/href) from reading local files or making outbound HTTP(S) requests. The fix for GHSA-wqvq-jvpq-h66f (commit 5f69497) threaded these flags through the library's internal resolution paths (MailMessage.resolveAll() and convertDataImages()), but the public plugin API MailMessage.resolveContent(...args) (lib/mailer/mail-message.js:41-43) remains a raw passthrough to shared.resolveContent(). When called with the documented legacy signature mail.resolveContent(data, key, callback), shared.resolveContent normalizes the missing options argument to an empty object (options = options || {}, lib/shared/index.js:530). The message-level flags that the MailMessage constructor already copied into mail.data (lib/mailer/mail-message.js:34-38) are silently discarded, so resolveContentValue skips both access-control guards and…
Recommended action: Upgrade to 9.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Message-level raw option bypasses disableFileAccess / disableUrlAccess, enabling arbitrary file read and full-response SSRF in the sent message - Target: nodemailer/nodemailer, npm nodemailer v9.0.0 (HEAD 4e58450eb490e5097a74b2b2cce35a8d9e21856e) - Verdict: CONFIRMED (local PoC, no network) Summary Nodemailer exposes disableFileAccess and disableUrlAccess so an application that passes untrusted message data to the library can forbid that data from reading local files or fetching URLs. Every attachment, alternative, html/text/watchHtml/amp and icalEvent content node honors these flags. The message-level raw option does not. MailComposer.compile() builds the root MIME node for a raw message without threading the two flags, so a raw: { path: '/etc/passwd' } or raw: { href: 'http://169.254.169.254/…' } message is read / fetched anyway, and the file or HTTP-response bytes become the actual message that is sent by every transport (SMTP, SES, sendmail, stream, JSON). An actor whose input…
Recommended action: Upgrade to 9.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Nodemailer constructs List- headers from the caller-provided list message option using internally prepared header values. The list..comment field is inserted into those prepared values without removing CR (\r) or LF (\n) characters. Because prepared headers bypass the normal header-value sanitizer and are passed to mimeFuncs.foldLines(), a CRLF sequence in a list comment is emitted as an actual header boundary in the generated RFC822 message. An application that lets a lower-privileged or unauthenticated user influence list.help.comment, list.unsubscribe.comment, list.subscribe.comment, list.post.comment, list.owner.comment, list.archive.comment, or list.id.comment can therefore be made to generate messages containing attacker-chosen additional headers. Details Source-to-sink evidence: - lib/mailer/mail-message.js:241-249 calls getListHeaders(this.data.list) and adds each returned value with this.message.addHeader(listHeader.key, value). - lib/mailer/mail-message.js:253-296…
Recommended action: Upgrade to 8.0.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Nodemailer's disableFileAccess and disableUrlAccess options are intended to prevent message content and attachments from reading local files or fetching URLs. The normal MIME streaming path enforces those options in MimeNode.getStream(). However, jsonTransport serializes messages by calling mail.normalize(), which resolves html, text, alternatives, calendar events, and attachments through shared.resolveContent() before MIME generation. shared.resolveContent() reads local files and fetches HTTP(S) URLs directly, without receiving or checking disableFileAccess or disableUrlAccess. As a result, applications that use jsonTransport as a safe serializer or queue payload generator while relying on disableFileAccess / disableUrlAccess can still be made to read local files into the generated JSON output or make outbound HTTP requests when an attacker controls message content fields such as attachment path or text.href. The same missing-enforcement root cause is also reachable before…
Recommended action: Upgrade to 8.0.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Nodemailer disables TLS certificate verification in its internal HTTPS fetch client through the use of rejectUnauthorized: false inside lib/fetch/index.js. As a result, OAuth2 token requests trust invalid or self-signed HTTPS certificates and transmit sensitive OAuth credentials over connections that should fail TLS validation. An attacker in a machine-in-the-middle position can intercept OAuth2 credential exchanges and capture: - OAuth clientsecret - refreshtoken - access tokens The issue was verified through runtime testing using a self-signed HTTPS OAuth endpoint. Details Root Cause The issue originates from the internal HTTPS fetch implementation used by Nodemailer for OAuth2 token retrieval and related outbound HTTPS requests. Inside: lib/fetch/index.js the request options contain: rejectUnauthorized: false This disables TLS peer certificate verification globally for the internal HTTPS client unless explicitly overridden through optional TLS configuration. As a result: -…
Recommended action: Upgrade to 8.0.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Nodemailer versions up to and including 8.0.4 are vulnerable to SMTP command injection via CRLF sequences in the transport name configuration option. The name value is used directly in the EHLO/HELO SMTP command without any sanitization for carriage return and line feed characters (\r\n). An attacker who can influence this option can inject arbitrary SMTP commands, enabling unauthorized email sending, email spoofing, and phishing attacks. Details The vulnerability exists in lib/smtp-connection/index.js. When establishing an SMTP connection, the name option is concatenated directly into the EHLO command: The sendCommand method writes the string directly to the socket followed by \r\n (line 1082): If the name option contains \r\n sequences, each injected line is interpreted by the SMTP server as a separate command. Unlike the envelope.from and envelope.to fields which are validated for \r\n (line 1107-1119), and unlike envelope.size which was recently fixed…
Recommended action: Upgrade to 8.0.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When a custom envelope object is passed to sendMail() with a size property containing CRLF characters (\r\n), the value is concatenated directly into the SMTP MAIL FROM command without sanitization. This allows injection of arbitrary SMTP commands, including RCPT TO — silently adding attacker-controlled recipients to outgoing emails. Details In lib/smtp-connection/index.js (lines 1161-1162), the envelope.size value is concatenated into the SMTP MAIL FROM command without any CRLF sanitization: This contrasts with other envelope parameters in the same function that ARE properly sanitized: - Addresses (from, to): validated for [\r\n<] at lines 1107-1127 - DSN parameters (dsn.ret, dsn.envid, dsn.orcpt): encoded via encodeXText() at lines 1167-1183 The size property reaches this code path through MimeNode.setEnvelope() in lib/mime-node/index.js (lines 854-858), which copies all non-standard envelope properties verbatim: Since sendCommand() writes the command string followed by…
Recommended action: Upgrade to 8.0.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The email parsing library incorrectly handles quoted local-parts containing @. This leads to misrouting of email recipients, where the parser extracts and routes to an unintended domain instead of the RFC-compliant target. Payload: "xclow3n@gmail.com x"@internal.domain Using the following code to send mail Running the script and seeing how this mail is parsed according to RFC But the email is sent to xclow3n@gmail.com <img width="2128" height="439" alt="Image" src="https://github.com/user-attachments/assets/20eb459c-9803-45a2-b30e-5d1177d60a8d" / Impact: - Misdelivery / Data leakage: Email is sent to psres.net instead of test.com. - Filter evasion: Logs and anti-spam systems may be bypassed by hiding recipients inside quoted local-parts. - Potential compliance issue: Violates RFC 5321/5322 parsing rules. - Domain based access control bypass in downstream applications using your library to send mails Recommendations - Fix parser to correctly treat quoted local-parts per RFC 5321/5322.…
Recommended action: Upgrade to 7.0.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A ReDoS vulnerability occurs when nodemailer tries to parse img files with the parameter attachDataUrls set, causing the stuck of event loop. Another flaw was found when nodemailer tries to parse an attachments with a embedded file, causing the stuck of event loop. Details Regex: /^data:((?:[^;];)(?:[^,])),(.)$/ Path: compile - getAttachments - processDataUrl Regex: /(<img\b[^] src\s=[\s"'])(data:([^;]+);[^"'\s]+)/ Path: convertDataImages PoC https://gist.github.com/francoatmega/890dd5053375333e40c6fdbcc8c58df6 https://gist.github.com/francoatmega/9aab042b0b24968d7b7039818e8b2698 Impact ReDoS causes the event loop to stuck a specially crafted evil email can cause this problem.
Recommended action: Upgrade to 6.9.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object.
Recommended action: Upgrade to 6.6.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.