What is the CVSS score of CVE-2025-14874?

CVE-2025-14874 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.6%.

Which versions of Nodemailer are affected by CVE-2025-14874?

Nodemailer, a widely used Node.js email library, contains an unbounded recursion flaw in its address parser affecting versions 3.0.0 through 7.0.10; an unauthenticated attacker can send a crafted…. A patch is available.

Is there a public PoC exploit available for CVE-2025-14874?

Yes, a public proof-of-concept exploit is available for CVE-2025-14874. Prioritise patching immediately. EPSS: 0.6%.

How to fix or mitigate CVE-2025-14874?

Within 24 hours, inventory all Node.js applications and dependencies for Nodemailer versions 3.0.0 through 7.0.10, identify any endpoint or job that passes attacker-controlled address strings into the parser, and temporarily disable or sanitize such input while monitoring logs for crashes or 'Maximum call stack size exceeded' errors. Within 7 days, patch available per vendor advisory: upgrade Nodemailer to the vendor-fixed version once confirmed and redeploy affected services after regression testing. Within 30 days, add validation that rejects malformed or deeply nested RFC 5322 address headers before parsing, implement rate limiting or queue isolation for email-processing workers, and verify through dependency scanning that no vulnerable Nodemailer versions remain in production or CI/CD pipelines.

Nodemailer CVE-2025-14874

HIGH

Improper Check or Handling of Exceptional Conditions (CWE-703)

2025-12-18 secalert@redhat.com

Denial Of Service Red Hat Advanced Cluster Management For Kubernetes Ceph Storage Developer Hub Nodemailer Red Hat

7.5

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Single unauthenticated network request with no user interaction crashes the process; availability-only impact with no confidentiality or integrity effect, hence A:H and C:N/I:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Metadata Corrected

Sep 30, 2026 - 21:40 vuln.today

tag: Red Hat added

Analysis Generated

Sep 30, 2026 - 21:23 vuln.today

CVE Published

Dec 18, 2025 - 09:15 cve.org

HIGH 7.5

DescriptionCVE.org

A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the address parser.

AnalysisAI

Unbounded recursion in Nodemailer's address parser (npm package versions 3.0.0 through 7.0.10) allows a single crafted email address header to crash the Node.js process, causing a denial of service. Because nested RFC 5322 group syntax is not legal, the parser flattens nested groups by recursively re-invoking itself, and an attacker-controlled header containing many 'label:' colon tokens drives that recursion until the stack is exhausted and the runtime throws 'Maximum call stack size exceeded'. Exploitation requires no authentication, no user interaction, and no special configuration (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5), but it only works where an application passes untrusted address strings into the parser; publicly available exploit code exists, EPSS is low at 0.56% (44th percentile), and there is no confirmed active exploitation (no CISA KEV listing).

Technical ContextAI

The vulnerable component is lib/addressparser/index.js, the RFC 5322 address parser bundled with Nodemailer. RFC 5322 defines groups using a colon ('Group: member1, member2;') and uses commas to separate members; nested groups are explicitly not allowed. To tolerate malformed real-world input, _handleAddress() flattens any group it encounters by calling addressparser(data.group.join(',')) recursively, and in an attacker payload such as 'g0: g1: g2: ... gN: victim@example.com;' each colon token causes the resulting group body to be re-parsed, producing the cycle addressparser → _handleAddress → addressparser → ... with no depth bound. The flaw is tracked as CWE-703 (Improper Check or Handling of Exceptional Conditions) and corresponds to the uncontrolled-recursion/stack-exhaustion class (CWE-674): recursion depth scales linearly with the number of attacker-supplied colons, so V8 eventually raises 'Maximum call stack size exceeded' and the process terminates. The impact is availability-only with no confidentiality or integrity loss. The upstream fix threads a depth counter through _handleAddress/addressparser and introduces MAX_NESTED_GROUP_DEPTH = 50, returning an empty array for input nested deeper than the limit so that even 3,000- or 10,000-level malicious payloads parse in under a second instead of crashing; accompanying tests confirm truncation beyond depth 50 while preserving legitimate grouped addresses. The CPE cpe:2.3:a:nodemailer:nodemailer:*:*:*:*:*:node.js:*:* reflects the whole unspecific version range of the Node.js library, and the same code is repackaged to downstream consumers including Red Hat Advanced Cluster Management for Kubernetes 2.0, Red Hat Ceph Storage 8.0, and Red Hat Developer Hub.

RemediationAI

Vendor-released patch: upgrade the npm nodemailer package to 7.0.11 or later (fixed from >= 3.0.0 through <= 7.0.10), which enforces MAX_NESTED_GROUP_DEPTH = 50 and safely truncates deeper input; the fix is the commit https://github.com/nodemailer/nodemailer/commit/b61b9c0cfd682b6f647754ca338373b68336a150 (second patch ref: https://github.com/nodemailer/nodemailer/commit/6218b8df), detailed in advisory https://github.com/nodemailer/nodemailer/security/advisories/GHSA-rcmh-qjqh-p98v. No fixed version is listed for the Maven redistribution org.webjars.npm:nodemailer (affected >= 3.0.0 through <= 6.10.1), so consumers of that artifact must either upgrade to the patched upstream npm module, vendor a repackaged build containing the depth-limit commit, or move to a maintained alternative; Red Hat product users should follow the mitigation guidance in https://access.redhat.com/security/cve/CVE-2025-14874 until an errata bundles the updated library. Until patching is possible, the most effective compensating control is to keep untrusted input away from lib/addressparser/index.js: validate or reject inbound To/From/Cc/group header values before parsing - for example cap header length and reject any address string containing multiple RFC 5322 group delimiters - with the trade-off that legitimate (RFC 5322-illegal but tolerated) nested-group addresses will no longer be flattened, so only apply strict rejection on externally sourced headers. Applications that only parse hardcoded or operator-defined addresses are not realistically exposed and can deprioritize the change. Because a triggered overflow terminates the process, run mail-sending or address-processing services under a supervisor with automatic restart (systemd, PM2, or a Kubernetes liveness/restart policy) so a crash degrades to a brief outage rather than a persistent denial of service, and consider running the parser in a worker thread or isolated process to contain the failure - noting these are containment measures, not fixes, since restart loops still impose availability cost under sustained attack.