Nodemailer Address Parser Vulnerability: Early Warning
- Severity
- HIGH
- Affected component
- nodemailer (npm)
- Affected versions
- < 8.0.9 or < 9.1.0 or < 6.4.16 or < 9.1.1 or < 6.9.9 or < 8.0.4 or >= 6.9.16, < 9.1.0 or < 6.6.1 or < 7.0.7 or < 9.0.1 or < 8.0.8 or >= 3.0.0, < 7.0.11 or < 8.0.5 or < 9.1.0 or < 8.0.9
- Patched version
- Not yet available
An early warning has been issued for a high severity vulnerability in Nodemailer's address parser. This issue, which has a quadratic time complexity, could allow remote denial of service.
What happened
Nodemailer's address parser reportedly has a vulnerability with quadratic time complexity. This flaw could allow a remote denial of service attack via a specially crafted address list. The attack consumes CPU resources proportional to the square of the number of addresses, potentially blocking Node's event loop. This vulnerability is under investigation and no exploitation in the wild has been confirmed.
The affected versions include those less than 8.0.9 or 9.1.0 or 6.4.16 or 9.1.1 or 6.9.9 or 8.0.4 or greater than or equal to 6.9.16 but less than 9.1.0 or less than 6.6.1 or 7.0.7 or 9.0.1 or 8.0.8 or greater than or equal to 3.0.0 but less than 7.0.11 or 8.0.5 or 9.1.0 or 8.0.9. Users of these versions should assess their exposure and prepare for potential upgrades.
What to do about it
- Review your Nodemailer installations to determine if you are running an affected version.
- Monitor the official Nodemailer and OSV sources for updates on patches.
- Prepare to upgrade to a fixed version as soon as it is available.
- Implement rate limiting or other mitigations to reduce the impact of a potential denial of service attack.
- No official fix has been published yet. Monitor the sources below for updates.
How 0Day would have caught this
nodemailer is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using Nodemailer versions less than 8.0.9 or 9.1.0 or 6.4.16 or 9.1.1 or 6.9.9 or 8.0.4 or greater than or equal to 6.9.16 but less than 9.1.0 or less than 6.6.1 or 7.0.7 or 9.0.1 or 8.0.8 or greater than or equal to 3.0.0 but less than 7.0.11 or 8.0.5 or 9.1.0 or 8.0.9.
What should I do right now?
Review your Nodemailer installations and prepare to upgrade to a fixed version as soon as it is available. Monitor the official sources for updates.
Is there a patch available?
No official fix has been published yet. Continue to monitor the sources for updates.