Description
Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms to consume excessive CPU and block the Node.js event loop for several seconds, causing denial of service.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
nodemailer nodemailer
Default version status: unaffected
9.1.0 to < 10.0.5affected10.0.5unaffected
pkg:npm/nodemailerReferences
- https://github.com/nodemailer/nodemailer/security/advisories/GHSA-prgh-xp8r-p3m5 ↗
- https://github.com/nodemailer/nodemailer/commit/c07f17518d25aca8ab2ad66968dcbca538c24b89 ↗
- https://github.com/nodemailer/nodemailer/blob/v10.0.4/src/addressparser/index.ts#L251 ↗
- https://github.com/nodemailer/nodemailer/releases/tag/v10.0.5 ↗
- https://github.com/nodemailer/nodemailer ↗
- https://www.vulncheck.com/advisories/nodemailer-9.1.0-through-10.0.4-denial-of-service-via-quadratic-address-parsing ↗