Developer Hub
Monthly
Unbounded recursion in Nodemailer's address parser (npm package versions 3.0.0 through 7.0.10) allows a single crafted email address header to crash the Node.js process, causing a denial of service. Because nested RFC 5322 group syntax is not legal, the parser flattens nested groups by recursively re-invoking itself, and an attacker-controlled header containing many 'label:' colon tokens drives that recursion until the stack is exhausted and the runtime throws 'Maximum call stack size exceeded'. Exploitation requires no authentication, no user interaction, and no special configuration (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5), but it only works where an application passes untrusted address strings into the parser; publicly available exploit code exists, EPSS is low at 0.56% (44th percentile), and there is no confirmed active exploitation (no CISA KEV listing).
Unbounded recursion in Nodemailer's address parser (npm package versions 3.0.0 through 7.0.10) allows a single crafted email address header to crash the Node.js process, causing a denial of service. Because nested RFC 5322 group syntax is not legal, the parser flattens nested groups by recursively re-invoking itself, and an attacker-controlled header containing many 'label:' colon tokens drives that recursion until the stack is exhausted and the runtime throws 'Maximum call stack size exceeded'. Exploitation requires no authentication, no user interaction, and no special configuration (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5), but it only works where an application passes untrusted address strings into the parser; publicly available exploit code exists, EPSS is low at 0.56% (44th percentile), and there is no confirmed active exploitation (no CISA KEV listing).