Nodemailer
Monthly
Stack exhaustion in Nodemailer before 10.0.2 allows unauthenticated remote attackers to crash an affected Node.js process by supplying a deeply nested JSON array in a recipient field (to, cc, or bcc) that the library flattens recursively until the call stack is exhausted. The flaw is only reachable through a host application that accepts externally controlled recipient input and passes it into Nodemailer message options without validating or bounding array nesting depth, so real-world impact is a recoverable denial of service with no data exposure or code execution. No KEV listing, EPSS signal, or public exploit code was identified at time of analysis, and the vendor has released a patched version (10.0.2); the issue is tracked as EUVD-2026-87675 and GHSA-8vvx-rff5-p5rq.
Denial of service in Nodemailer versions before 10.0.6 lets remote, unauthenticated attackers stall the Node.js event loop for tens of seconds by supplying crafted email address or header values that trigger quadratic backtracking in the addressparser free-text fallback regex. The flaw is only reachable when an application routes attacker-controllable strings into nodemailer's address parsing - user-supplied recipient or sender fields, contact-form addresses, or inbound headers - and the impact is availability only, with no crash, code execution, or data exposure since the affected process simply stops responding while the single-threaded event loop is blocked. No public exploit code has been identified at time of analysis, and upgrading to nodemailer 10.0.6 fully remediates the issue.
Quadratic time complexity in Nodemailer's addressparser component, versions 9.1.0 through 10.0.4, allows remote unauthenticated attackers to block the Node.js event loop for multiple seconds by supplying crafted email addresses containing RFC 5322 comment-separated atoms. The root cause is a `slice(-1)` call on a growing string accumulator in `_handleAddress` that forces JavaScript engine string-flattening on every token, producing O(n²) parse time - empirical test data in the fix commit shows 1.5 MB of crafted input caused approximately 10 seconds of event-loop stall before the patch. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the attack payload is trivially constructable by simple string repetition and requires no authentication.
SMTP command injection in Nodemailer before 8.0.4 lets attackers smuggle arbitrary SMTP verbs (notably RCPT TO) into outgoing mail by planting CRLF characters in the envelope.size value, silently adding attacker-controlled recipients or otherwise manipulating the MAIL FROM dialogue. Only applications that pass a custom envelope object and expose its size property to untrusted input are affected, since Nodemailer's default auto-constructed envelope never sets size. A working proof-of-concept is published in the GHSA advisory; there is no public exploit identified beyond that PoC and no evidence of active exploitation.
TLS certificate verification is disabled by hardcoded `rejectUnauthorized: false` in Nodemailer's internal HTTPS fetch client (lib/fetch/index.js), exposing OAuth2 token exchanges to machine-in-the-middle interception in all versions prior to 8.0.8. Any attacker with a MITM position on the network path between a Nodemailer-based application and its OAuth2 token endpoint can silently capture OAuth client secrets, refresh tokens, and access tokens from connections that appear valid to the application. A reporter-verified proof-of-concept demonstrating the full interception flow against a self-signed HTTPS OAuth endpoint exists; no confirmed active exploitation in CISA KEV at time of analysis.
Sandbox bypass in nodemailer <= 9.0.0 exposes arbitrary file read and full-response SSRF to any authenticated application user whose input reaches the message-level `raw` option. The `disableFileAccess` and `disableUrlAccess` flags - intended to sandbox untrusted message data - are correctly threaded through all other content node builders but are silently omitted when a `MimeNode` is constructed for a `raw` message in `lib/mail-composer/index.js:34-35`, leaving the raw path completely unrestricted. Exfiltrated file contents or HTTP response bodies are delivered as the actual RFC822 message via every supported transport (SMTP, SES, sendmail, stream, JSON) to an attacker-controlled recipient. A local PoC is confirmed per GHSA-p6gq-j5cr-w38f; no KEV listing and no EPSS data are available.
TLS certificate validation bypass in Nodemailer 5.0.0 through 10.0.1 allows an attacker who can prime a process-global DNS cache to make a victim direct-TLS/SMTPS transport connect to the attacker's SNI virtual host and accept the attacker's certificate, even with rejectUnauthorized: true, potentially disclosing SMTP credentials. Exploitation is conditional: it requires two or more secure:true transports resolving the same non-IP hostname with different tls.servername values in the same Node.js process, plus a low-privileged attacker capable of winning a cache-priming race (assessed CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N). No public exploit code or confirmed active exploitation was identified at time of analysis; the vendor fixed the cache-key confusion in Nodemailer 10.0.2.
Remote, unauthenticated attackers can exploit mis-parsing of recipient addresses in Nodemailer versions 9.1.0 through 10.0.8 to inject extra attacker-controlled domain text into the SMTP envelope, but only when the hosting application forwards externally supplied recipient addresses without its own strict validation. The flaw combines a quoted local-part with trailing RFC 5322 comments, yielding normalized values such as 'user@example.com evil.com'; the advisory does not confirm that real SMTP servers would actually deliver to an unintended recipient, and the impact is integrity-only with no confidentiality or availability effect. No public exploit identified at time of analysis (no CISA KEV, no POC observed).
SMTP command injection in Nodemailer (npm) versions up to and including 8.0.4 allows an attacker who can influence the transport `name` configuration option to inject arbitrary SMTP commands by embedding CRLF sequences in the value. The EHLO, HELO, and LHLO commands are constructed via direct string concatenation in lib/smtp-connection/index.js without sanitization, enabling unauthorized email sending, spoofing, and phishing through the configured SMTP relay. A proof-of-concept is publicly available in the GHSA advisory; no KEV listing is present, indicating exploitation has not been confirmed at mass scale at time of analysis.
CRLF injection in Nodemailer's List-* header construction allows any application-level user with control over list comment parameters to inject arbitrary RFC822 message headers into outbound emails. Versions up to and including 8.0.8 of the npm package are affected; the fix is available in 8.0.9. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, making this a medium-severity issue with practical impact confined to applications that expose the list comment API surface to untrusted input.
Nodemailer's jsonTransport transport fails to enforce disableFileAccess and disableUrlAccess controls during message normalization in all versions prior to 8.0.9, allowing attackers with control over message content fields to read local filesystem content or trigger outbound SSRF-style HTTP requests. Applications that use jsonTransport as a safe serializer or queue payload generator while trusting those access-control options as a security boundary are the primary affected population. No public exploit code has been identified and the CVE is not in CISA KEV, but the flaw's mechanics are straightforward and fully documented in the GHSA advisory.
Versions of the package mailparser versions up to 3.9.3 is affected by cross-site scripting (xss) (CVSS 6.1).
Unbounded recursion in Nodemailer's address parser (npm package versions 3.0.0 through 7.0.10) allows a single crafted email address header to crash the Node.js process, causing a denial of service. Because nested RFC 5322 group syntax is not legal, the parser flattens nested groups by recursively re-invoking itself, and an attacker-controlled header containing many 'label:' colon tokens drives that recursion until the stack is exhausted and the runtime throws 'Maximum call stack size exceeded'. Exploitation requires no authentication, no user interaction, and no special configuration (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5), but it only works where an application passes untrusted address strings into the parser; publicly available exploit code exists, EPSS is low at 0.56% (44th percentile), and there is no confirmed active exploitation (no CISA KEV listing).
The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
This affects the package nodemailer before 6.4.16. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Stack exhaustion in Nodemailer before 10.0.2 allows unauthenticated remote attackers to crash an affected Node.js process by supplying a deeply nested JSON array in a recipient field (to, cc, or bcc) that the library flattens recursively until the call stack is exhausted. The flaw is only reachable through a host application that accepts externally controlled recipient input and passes it into Nodemailer message options without validating or bounding array nesting depth, so real-world impact is a recoverable denial of service with no data exposure or code execution. No KEV listing, EPSS signal, or public exploit code was identified at time of analysis, and the vendor has released a patched version (10.0.2); the issue is tracked as EUVD-2026-87675 and GHSA-8vvx-rff5-p5rq.
Denial of service in Nodemailer versions before 10.0.6 lets remote, unauthenticated attackers stall the Node.js event loop for tens of seconds by supplying crafted email address or header values that trigger quadratic backtracking in the addressparser free-text fallback regex. The flaw is only reachable when an application routes attacker-controllable strings into nodemailer's address parsing - user-supplied recipient or sender fields, contact-form addresses, or inbound headers - and the impact is availability only, with no crash, code execution, or data exposure since the affected process simply stops responding while the single-threaded event loop is blocked. No public exploit code has been identified at time of analysis, and upgrading to nodemailer 10.0.6 fully remediates the issue.
Quadratic time complexity in Nodemailer's addressparser component, versions 9.1.0 through 10.0.4, allows remote unauthenticated attackers to block the Node.js event loop for multiple seconds by supplying crafted email addresses containing RFC 5322 comment-separated atoms. The root cause is a `slice(-1)` call on a growing string accumulator in `_handleAddress` that forces JavaScript engine string-flattening on every token, producing O(n²) parse time - empirical test data in the fix commit shows 1.5 MB of crafted input caused approximately 10 seconds of event-loop stall before the patch. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the attack payload is trivially constructable by simple string repetition and requires no authentication.
SMTP command injection in Nodemailer before 8.0.4 lets attackers smuggle arbitrary SMTP verbs (notably RCPT TO) into outgoing mail by planting CRLF characters in the envelope.size value, silently adding attacker-controlled recipients or otherwise manipulating the MAIL FROM dialogue. Only applications that pass a custom envelope object and expose its size property to untrusted input are affected, since Nodemailer's default auto-constructed envelope never sets size. A working proof-of-concept is published in the GHSA advisory; there is no public exploit identified beyond that PoC and no evidence of active exploitation.
TLS certificate verification is disabled by hardcoded `rejectUnauthorized: false` in Nodemailer's internal HTTPS fetch client (lib/fetch/index.js), exposing OAuth2 token exchanges to machine-in-the-middle interception in all versions prior to 8.0.8. Any attacker with a MITM position on the network path between a Nodemailer-based application and its OAuth2 token endpoint can silently capture OAuth client secrets, refresh tokens, and access tokens from connections that appear valid to the application. A reporter-verified proof-of-concept demonstrating the full interception flow against a self-signed HTTPS OAuth endpoint exists; no confirmed active exploitation in CISA KEV at time of analysis.
Sandbox bypass in nodemailer <= 9.0.0 exposes arbitrary file read and full-response SSRF to any authenticated application user whose input reaches the message-level `raw` option. The `disableFileAccess` and `disableUrlAccess` flags - intended to sandbox untrusted message data - are correctly threaded through all other content node builders but are silently omitted when a `MimeNode` is constructed for a `raw` message in `lib/mail-composer/index.js:34-35`, leaving the raw path completely unrestricted. Exfiltrated file contents or HTTP response bodies are delivered as the actual RFC822 message via every supported transport (SMTP, SES, sendmail, stream, JSON) to an attacker-controlled recipient. A local PoC is confirmed per GHSA-p6gq-j5cr-w38f; no KEV listing and no EPSS data are available.
TLS certificate validation bypass in Nodemailer 5.0.0 through 10.0.1 allows an attacker who can prime a process-global DNS cache to make a victim direct-TLS/SMTPS transport connect to the attacker's SNI virtual host and accept the attacker's certificate, even with rejectUnauthorized: true, potentially disclosing SMTP credentials. Exploitation is conditional: it requires two or more secure:true transports resolving the same non-IP hostname with different tls.servername values in the same Node.js process, plus a low-privileged attacker capable of winning a cache-priming race (assessed CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N). No public exploit code or confirmed active exploitation was identified at time of analysis; the vendor fixed the cache-key confusion in Nodemailer 10.0.2.
Remote, unauthenticated attackers can exploit mis-parsing of recipient addresses in Nodemailer versions 9.1.0 through 10.0.8 to inject extra attacker-controlled domain text into the SMTP envelope, but only when the hosting application forwards externally supplied recipient addresses without its own strict validation. The flaw combines a quoted local-part with trailing RFC 5322 comments, yielding normalized values such as 'user@example.com evil.com'; the advisory does not confirm that real SMTP servers would actually deliver to an unintended recipient, and the impact is integrity-only with no confidentiality or availability effect. No public exploit identified at time of analysis (no CISA KEV, no POC observed).
SMTP command injection in Nodemailer (npm) versions up to and including 8.0.4 allows an attacker who can influence the transport `name` configuration option to inject arbitrary SMTP commands by embedding CRLF sequences in the value. The EHLO, HELO, and LHLO commands are constructed via direct string concatenation in lib/smtp-connection/index.js without sanitization, enabling unauthorized email sending, spoofing, and phishing through the configured SMTP relay. A proof-of-concept is publicly available in the GHSA advisory; no KEV listing is present, indicating exploitation has not been confirmed at mass scale at time of analysis.
CRLF injection in Nodemailer's List-* header construction allows any application-level user with control over list comment parameters to inject arbitrary RFC822 message headers into outbound emails. Versions up to and including 8.0.8 of the npm package are affected; the fix is available in 8.0.9. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, making this a medium-severity issue with practical impact confined to applications that expose the list comment API surface to untrusted input.
Nodemailer's jsonTransport transport fails to enforce disableFileAccess and disableUrlAccess controls during message normalization in all versions prior to 8.0.9, allowing attackers with control over message content fields to read local filesystem content or trigger outbound SSRF-style HTTP requests. Applications that use jsonTransport as a safe serializer or queue payload generator while trusting those access-control options as a security boundary are the primary affected population. No public exploit code has been identified and the CVE is not in CISA KEV, but the flaw's mechanics are straightforward and fully documented in the GHSA advisory.
Versions of the package mailparser versions up to 3.9.3 is affected by cross-site scripting (xss) (CVSS 6.1).
Unbounded recursion in Nodemailer's address parser (npm package versions 3.0.0 through 7.0.10) allows a single crafted email address header to crash the Node.js process, causing a denial of service. Because nested RFC 5322 group syntax is not legal, the parser flattens nested groups by recursively re-invoking itself, and an attacker-controlled header containing many 'label:' colon tokens drives that recursion until the stack is exhausted and the runtime throws 'Maximum call stack size exceeded'. Exploitation requires no authentication, no user interaction, and no special configuration (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5), but it only works where an application passes untrusted address strings into the parser; publicly available exploit code exists, EPSS is low at 0.56% (44th percentile), and there is no confirmed active exploitation (no CISA KEV listing).
The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
This affects the package nodemailer before 6.4.16. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.