A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the address parser.
Weakness
The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Nodemailer | Nodemailer | * | 7.0.11 (excluding) |
| Node-nodemailer | Ubuntu | plucky | * |
References
- https://access.redhat.com/security/cve/CVE-2025-14874
- https://bugzilla.redhat.com/show_bug.cgi?id=2418133
- https://github.com/nodemailer/nodemailer
- https://github.com/nodemailer/nodemailer/commit/b61b9c0cfd682b6f647754ca338373b68336a150
- https://github.com/nodemailer/nodemailer/security/advisories/GHSA-rcmh-qjqh-p98v
- https://bugzilla.redhat.com/show_bug.cgi?id=2418133
- https://github.com/nodemailer/nodemailer/security/advisories/GHSA-rcmh-qjqh-p98v