Nodemailer Address Parser Vulnerability: Early Warning
- Severity
- HIGH
- Affected component
- nodemailer (npm)
- Affected versions
- < 8.0.9 or < 9.1.0 or < 6.4.16 or < 9.1.1 or < 6.9.9 or < 8.0.4 or >= 6.9.16, < 9.1.0 or < 6.6.1 or < 7.0.7 or < 9.0.1 or < 8.0.8 or >= 3.0.0, < 7.0.11 or < 8.0.5 or < 9.1.0 or < 8.0.9
- Patched version
- Not yet available
An early warning has been issued for a vulnerability in Nodemailer's address parser that could allow remote denial of service. Users of affected versions should take immediate action.
What happened
An early warning has been issued regarding a vulnerability in Nodemailer's address parser. This vulnerability, tracked as GHSA-2X7J-588G-CCC2, reportedly has a quadratic time complexity that could allow a remote denial of service attack via a specially crafted address list. This issue could block Node's event loop, denying service to other requests. The vulnerability has not yet been exploited in the wild according to the current data.
The affected versions of nodemailer (npm) are those less than 8.0.9 or 9.1.0 or 6.4.16 or 9.1.1 or 6.9.9 or 8.0.4 or greater than or equal to 6.9.16 but less than 9.1.0 or less than 6.6.1 or 7.0.7 or 9.0.1 or 8.0.8 or greater than or equal to 3.0.0 but less than 7.0.11 or less than 8.0.5 or 9.1.0 or 8.0.9. Users of these versions are advised to assess their exposure and take appropriate action.
What to do about it
- Check your nodemailer (npm) version against the affected ranges provided above.
- No official fix has been published yet. Monitor the Nodemailer maintainers and the provided sources for updates on a patch.
- Consider implementing rate limiting or other mitigations to reduce the risk of denial of service while waiting for a patch.
- Review your application's use of the address parser and consider alternative implementations if feasible.
- Stay informed by following updates from the Nodemailer project and security advisories.
How 0Day would have caught this
nodemailer is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using a version of nodemailer (npm) that is less than 8.0.9 or 9.1.0 or 6.4.16 or 9.1.1 or 6.9.9 or 8.0.4 or greater than or equal to 6.9.16 but less than 9.1.0 or less than 6.6.1 or 7.0.7 or 9.0.1 or 8.0.8 or greater than or equal to 3.0.0 but less than 7.0.11 or less than 8.0.5 or 9.1.0 or 8.0.9.
What should I do right now?
Check your nodemailer (npm) version and monitor for updates from the Nodemailer maintainers regarding a fix for this vulnerability.
Is there a patch available?
No official fix has been published yet. Continue to monitor the sources for updates on a patch.