nodemailer@4.6.2

nodemailer is an Easy as cake e-mail sending from your Node.js applications

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) in the AUTH mechanism detection of SMTPConnection._actionEHLO in src/smtp-connection/index.ts, where all four patterns contain (?:(\s+|=)[^\n]*\s+|\s+|=) before the mechanism literal, so [^\n]* and the trailing \s+ compete for the same whitespace and the engine tries every partition of the run before failing. An attacker who controls or intercepts the SMTP peer can stall the whole Node.js process, suspending every other request, timer, and connection in it, by answering EHLO with a line such as 250-AUTH followed by a long whitespace run and a token that matches no mechanism. This is reached before authentication on the first EHLO against a server offering no STARTTLS, on the second after a STARTTLS upgrade, or on the first when ignoreTLS is set, and the synchronous stall cannot be interrupted by the socket timeout, with roughly 4,000 whitespace characters already costing tens of seconds per pattern.

Upgrade nodemailer to version 10.0.13 or higher.

nodemailer is an Easy as cake e-mail sending from your Node.js applications

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the isPartialResponse function and the _onData method of SMTPConnection in src/smtp-connection/index.ts, where each continuation line is appended to the same response queue entry and the partial check re-runs str.slice(str.lastIndexOf('\n') + 1) over the whole accumulated string, forcing a full flatten of the V8 rope on every line. An attacker who controls or impersonates the SMTP peer can starve the event loop of the entire Node.js process, halting every other connection, request, and timer in it, and grow memory without bound, by streaming continuation lines such as 220-flood and never sending a completion line. This is reachable during the greeting and EHLO phases before the client authenticates or issues any command, the connection module applies no cap on accumulated reply size or line count, and the existing timers do not help, since greetingTimeout fires into an already starved loop and the inactivity socketTimeout resets on every inbound chunk.

Upgrade nodemailer to version 10.0.10 or higher.

nodemailer is an Easy as cake e-mail sending from your Node.js applications

Affected versions of this package are vulnerable to Improper Adherence to Coding Standards in the checkChar method of the Tokenizer class in src/addressparser/index.ts, where operatorExpecting holds a single expected closing character, so once < opens an address scope a following ( is not recognized as an operator and the RFC 5322 comment survives verbatim in the parsed address. An attacker can have a recipient address approved by an application's own domain allow-list check and then sent differently on the wire by supplying a value such as Legit User <user@good-corp.com(x)evil.com>, since the parentheses reach envelope.to and the RCPT TO command unchanged, where a conformant server rejects the transaction and a server that does strip comments resolves a different domain than the validator read. No recovery path applies, because _recoverAddrSpec returns immediately when the address contains no whitespace and the angle bracket path inserts none, and every field funnelling through MimeNode._parseAddresses, including to, cc, bcc, from, replyTo, and an explicit envelope, is affected identically.

Upgrade nodemailer to version 10.0.13 or higher.

nodemailer is an Easy as cake e-mail sending from your Node.js applications

Affected versions of this package are vulnerable to Uncontrolled Recursion via _parseAddresses in src/mime-node/index.ts when a recipient field is supplied as a deeply nested array. The native array-to-string conversion applied before passing the value to addressparser recurses once per nesting level, so a recipient wrapped in roughly a few thousand arrays (approximately 10 KB of JSON) exhausts the call stack and causes a RangeError. Because the compile step of sendMail was not wrapped in a try/catch, the synchronous throw escapes the callback chain and can crash the process.

Note: This is only exploitable if the caller does not catch the complete synchronous invocation of sendMail.

Upgrade nodemailer to version 10.0.2 or higher.

nodemailer is an Easy as cake e-mail sending from your Node.js applications

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the address parser in src/addressparser/index.ts, where the regex /\s*\b[^@\s]+@[^\s]+\b\s*/ was used to search free text for an email address. The [^@\s]+ quantifier causes quadratic backtracking: from every offset it rescans the run up to the next @ and then fails, advancing one character and repeating. An attacker who can supply a long whitespace-free string containing no usable @ character can block the Node.js event loop for tens of seconds, with 273 KB of input producing approximately 43 seconds of blocking.

Upgrade nodemailer to version 10.0.6 or higher.

nodemailer is an Easy as cake e-mail sending from your Node.js applications

Affected versions of this package are vulnerable to Interpretation Conflict through _normalizeAddress in lib/mime-node/index.js. An attacker can cause mail to be delivered to an attacker-controlled domain by supplying a recipient address whose domain contains an IDN-mapped or ignored code point, such as an invisible soft hyphen, that a standards-compliant domain check resolves to a trusted domain but Nodemailer encodes to a different xn-- label. This can make an application approve or display one recipient domain while Nodemailer sends the message to another external domain, exposing the intended email content and breaking domain-based recipient controls.

Upgrade nodemailer to version 9.1.0 or higher.

nodemailer is an Easy as cake e-mail sending from your Node.js applications

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the addressparser function in lib/addressparser/index.js. An attacker can block the Node.js event loop by supplying a crafted comma-separated address list, such as a To, Cc, Bcc, From, or Reply-To header value, that forces the parser to spend CPU time proportional to the square of the input size. This stalls email processing and delays or freezes every other request handled by the same process.

Upgrade nodemailer to version 9.1.0 or higher.

nodemailer is an Easy as cake e-mail sending from your Node.js applications

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the resolveContent() method in lib/mailer/mail-message.js. An attacker can read local files or trigger outbound URL fetches by supplying html or attachment content that is resolved through the legacy mail.resolveContent(data, key, callback) signature. When a plugin or application calls this API on a message created with disableFileAccess or disableUrlAccess, the access policy is dropped and the content resolver reaches fs.createReadStream() or nmfetch(), exposing server files or causing SSRF.

Upgrade nodemailer to version 9.1.1 or higher.

nodemailer is an Easy as cake e-mail sending from your Node.js applications

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the message-level raw option bypassing disableFileAccess and disableUrlAccess flags. An attacker can access arbitrary local files or perform server-side request forgery by supplying crafted input to the raw field, which bypasses intended access restrictions and results in sensitive data being sent to an attacker-controlled recipient.

Upgrade nodemailer to version 9.0.1 or higher.

nodemailer is an Easy as cake e-mail sending from your Node.js applications

Affected versions of this package are vulnerable to Missing Authorization in the jsonTransport message, which fails to enforce file and URL access restrictions during message normalization. An attacker can access local files or trigger outbound HTTP requests by supplying crafted message content fields such as attachment path or text.href.

Upgrade nodemailer to version 8.0.9 or higher.

nodemailer is an Easy as cake e-mail sending from your Node.js applications

Affected versions of this package are vulnerable to CRLF Injection via the comment field in the list message option. An attacker can inject arbitrary headers into generated email messages by supplying crafted input containing CRLF sequences.

Upgrade nodemailer to version 8.0.9 or higher.

nodemailer is an Easy as cake e-mail sending from your Node.js applications

Affected versions of this package are vulnerable to Improper Certificate Validation due to the use of rejectUnauthorized: false in the internal HTTPS client, which disables TLS certificate verification during OAuth2 token retrieval. An attacker can intercept sensitive OAuth2 credentials and tokens by performing a machine-in-the-middle attack on the HTTPS connection.

Upgrade nodemailer to version 8.0.8 or higher.

nodemailer is an Easy as cake e-mail sending from your Node.js applications

Affected versions of this package are vulnerable to CRLF Injection via the name configuration configuration option. An attacker can inject arbitrary SMTP commands by supplying carriage return and line feed sequences, enabling unauthorized email sending, sender spoofing, and phishing attacks before authentication occurs.

Upgrade nodemailer to version 8.0.5 or higher.

nodemailer is an Easy as cake e-mail sending from your Node.js applications

Affected versions of this package are vulnerable to CRLF Injection via the envelope.size parameter in the sendMail function. An attacker can inject arbitrary SMTP commands by supplying CRLF characters in the size property, which are concatenated directly into the SMTP command stream. This can result in unauthorized recipients being added to outgoing emails or other SMTP commands being executed.

Note:

This is only exploitable if the application explicitly passes a custom envelope object with a user-controlled size property to the mail sending process.

Upgrade nodemailer to version 8.0.4 or higher.

nodemailer is an Easy as cake e-mail sending from your Node.js applications

Affected versions of this package are vulnerable to Uncontrolled Recursion in the addressparser function. An attacker can cause the process to terminate immediately by sending an email address header containing deeply nested groups, separated by many :s.

Upgrade nodemailer to version 7.0.11 or higher.

nodemailer is an Easy as cake e-mail sending from your Node.js applications

Affected versions of this package are vulnerable to Interpretation Conflict due to improper handling of quoted local-parts containing @. An attacker can cause emails to be sent to unintended external recipients or bypass domain-based access controls by crafting specially formatted email addresses with quoted local-parts containing the @ character.

Upgrade nodemailer to version 7.0.7 or higher.

nodemailer is an Easy as cake e-mail sending from your Node.js applications

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the attachDataUrls parameter or when parsing attachments with an embedded file. An attacker can exploit this vulnerability by sending a specially crafted email that triggers inefficient regular expression evaluation, leading to excessive consumption of CPU resources.

Upgrade nodemailer to version 6.9.9 or higher.

nodemailer is an Easy as cake e-mail sending from your Node.js applications

Affected versions of this package are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object.

PoC:

const userEmail = 'foo@bar.comrnSubject: foobar'; // imagine this comes from e.g. HTTP request params or is otherwise user-controllable
await transporter.sendMail({
from: '...',
to: '...',
replyTo: {
name: 'Customer',
address: userEmail,
},
subject: 'My Subject',
text: message,
});

Upgrade nodemailer to version 6.6.1 or higher.