Improper Validation of Specified Quantity in Inputnodemailer is an Easy as cake e-mail sending from your Node.js applications
Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via the addressparser module's handling of quoted local-part addresses. When an address of the form "user"@good-corp.com(x)evil.com is parsed, the comment token ends the domain but leaves the trailing atoms in the same text buffer as the mailbox, causing the parser to produce the address user@good-corp.com evil.com. An application that validates the address it receives can be bypassed by supplying a quoted local-part spelling of the same value, allowing an attacker to inject a second, attacker-controlled domain into the envelope recipient.
How to fix Improper Validation of Specified Quantity in Input? Upgrade nodemailer to version 10.0.9 or higher.
| |
Uncontrolled Recursionnodemailer is an Easy as cake e-mail sending from your Node.js applications
Affected versions of this package are vulnerable to Uncontrolled Recursion via _parseAddresses in src/mime-node/index.ts when a recipient field is supplied as a deeply nested array. The native array-to-string conversion applied before passing the value to addressparser recurses once per nesting level, so a recipient wrapped in roughly a few thousand arrays (approximately 10 KB of JSON) exhausts the call stack and causes a RangeError. Because the compile step of sendMail was not wrapped in a try/catch, the synchronous throw escapes the callback chain and can crash the process.
Note: This is only exploitable if the caller does not catch the complete synchronous invocation of sendMail.
How to fix Uncontrolled Recursion? Upgrade nodemailer to version 10.0.2 or higher.
| |
Improper Certificate Validationnodemailer is an Easy as cake e-mail sending from your Node.js applications
Affected versions of this package are vulnerable to Improper Certificate Validation via the DNS cache in src/shared/index.ts, where the TLS server name (SNI) is stored alongside resolved addresses and keyed only by hostname. When two transports in the same process connect to the same host with different tls.servername values, the second transport inherits the server name cached by the first, sends it as SNI, and verifies the peer certificate against it. This allows an attacker to present a certificate issued for the first transport's server name to the second transport's connection, effectively bypassing certificate validation and enabling a MitM attack that exposes credentials sent to the wrong endpoint.
How to fix Improper Certificate Validation? Upgrade nodemailer to version 10.0.2 or higher.
| |
Inefficient Algorithmic Complexitynodemailer is an Easy as cake e-mail sending from your Node.js applications
Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the address parser in src/addressparser/index.ts, where the regex /\s*\b[^@\s]+@[^\s]+\b\s*/ was used to search free text for an email address. The [^@\s]+ quantifier causes quadratic backtracking: from every offset it rescans the run up to the next @ and then fails, advancing one character and repeating. An attacker who can supply a long whitespace-free string containing no usable @ character can block the Node.js event loop for tens of seconds, with 273 KB of input producing approximately 43 seconds of blocking.
How to fix Inefficient Algorithmic Complexity? Upgrade nodemailer to version 10.0.6 or higher.
| |
Inefficient Algorithmic Complexitynodemailer is an Easy as cake e-mail sending from your Node.js applications
Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in its address parser (src/addressparser/index.ts), whose join condition evaluates parts[parts.length - 1].slice(-1) before the cheaper token.value.charAt(0) check, flattening the accumulator on every token and making the parse quadratic in the length of the address value. An attacker can block the Node.js event loop for roughly 7 seconds per message, stalling all other work on it, by supplying an address value of about 640 KB whose atoms are separated by RFC 5322 comments, such as a@b(c)@b(c)@b(c).... This requires the application to parse untrusted addresses, which is reachable through mailparser wherever inbound email headers are processed.
How to fix Inefficient Algorithmic Complexity? Upgrade nodemailer to version 10.0.5 or higher.
| |
