Executive brief
nodemailer is a popular Node.js library for sending emails. A Regular Expression Denial of Service (ReDoS) vulnerability allows an attacker to send a specially crafted email that causes the application's event loop to freeze, potentially making the email service unavailable to legitimate users. An attacker can exploit this by crafting malicious data URLs in email attachments or image tags.
Technical details
The vulnerability is a ReDoS (Regular Expression Denial of Service) flaw caused by inefficient regex patterns in nodemailer's email parsing code (CWE-1333). Two vulnerable code paths were identified: one in _processDataUrl when handling data URL attachments, and another in _convertDataImages when processing embedded images with attachDataUrls enabled. Both regex patterns exhibit catastrophic backtracking when presented with specially crafted input, causing excessive CPU consumption and event loop blocking. The attack requires no authentication or user interaction—a remote attacker can send a malicious email to trigger the vulnerability. The fix was released in version 6.9.9, which replaced eternal matching patterns with limited occurrence patterns.
Affected products
- nodemailer nodemailer <= 6.9.8
Timeline
- 2024-01-31: disclosed
- 2024-02-01: patched: Version 6.9.9 released