Executive brief
Nodemailer, a popular library for sending emails in Node.js applications, is vulnerable to a denial-of-service attack. By sending a specially crafted email header with many nested groups (using colons), an attacker can cause the application to crash immediately. This can lead to service outages and, in some environments, trigger a continuous loop of restarts that exhausts server resources.
Technical details
A Denial of Service (DoS) vulnerability exists in Nodemailer's addressparser component due to improper handling of nested group structures as defined in RFC 5322. The parser attempts to flatten nested groups by recursively calling itself without an enforced depth limit. An attacker can provide a malicious email header containing a large number of colons (e.g., 'g0: g1: ... gN: victim@example.com;'), triggering infinite recursion that leads to a 'Maximum call stack size exceeded' error and immediate process termination. This is reachable via the network without authentication. The issue is fixed in version 7.0.11.
Affected products
- nodemailer nodemailer >= 3.0.0, <= 7.0.10
- org.webjars.npm nodemailer >= 3.0.0, <= 6.10.1
Timeline
- 2025-11-27: disclosed: Initial disclosure and patch release
- 2025-12-01: advisory: GitHub Advisory published