nodemailer@6.7.7

nodemailer is an Easy as cake e-mail sending from your Node.js applications

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the addressparser function in lib/addressparser/index.js. An attacker can block the Node.js event loop by supplying a crafted comma-separated address list, such as a To, Cc, Bcc, From, or Reply-To header value, that forces the parser to spend CPU time proportional to the square of the input size. This stalls email processing and delays or freezes every other request handled by the same process.

Upgrade nodemailer to version 9.1.0 or higher.

nodemailer is an Easy as cake e-mail sending from your Node.js applications

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the resolveContent() method in lib/mailer/mail-message.js. An attacker can read local files or trigger outbound URL fetches by supplying html or attachment content that is resolved through the legacy mail.resolveContent(data, key, callback) signature. When a plugin or application calls this API on a message created with disableFileAccess or disableUrlAccess, the access policy is dropped and the content resolver reaches fs.createReadStream() or nmfetch(), exposing server files or causing SSRF.

Upgrade nodemailer to version 9.1.1 or higher.

nodemailer is an Easy as cake e-mail sending from your Node.js applications

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the message-level raw option bypassing disableFileAccess and disableUrlAccess flags. An attacker can access arbitrary local files or perform server-side request forgery by supplying crafted input to the raw field, which bypasses intended access restrictions and results in sensitive data being sent to an attacker-controlled recipient.

Upgrade nodemailer to version 9.0.1 or higher.

nodemailer is an Easy as cake e-mail sending from your Node.js applications

Affected versions of this package are vulnerable to Missing Authorization in the jsonTransport message, which fails to enforce file and URL access restrictions during message normalization. An attacker can access local files or trigger outbound HTTP requests by supplying crafted message content fields such as attachment path or text.href.

Upgrade nodemailer to version 8.0.9 or higher.

nodemailer is an Easy as cake e-mail sending from your Node.js applications

Affected versions of this package are vulnerable to CRLF Injection via the comment field in the list message option. An attacker can inject arbitrary headers into generated email messages by supplying crafted input containing CRLF sequences.

Upgrade nodemailer to version 8.0.9 or higher.

nodemailer is an Easy as cake e-mail sending from your Node.js applications

Affected versions of this package are vulnerable to Improper Certificate Validation due to the use of rejectUnauthorized: false in the internal HTTPS client, which disables TLS certificate verification during OAuth2 token retrieval. An attacker can intercept sensitive OAuth2 credentials and tokens by performing a machine-in-the-middle attack on the HTTPS connection.

Upgrade nodemailer to version 8.0.8 or higher.

nodemailer is an Easy as cake e-mail sending from your Node.js applications

Affected versions of this package are vulnerable to CRLF Injection via the name configuration configuration option. An attacker can inject arbitrary SMTP commands by supplying carriage return and line feed sequences, enabling unauthorized email sending, sender spoofing, and phishing attacks before authentication occurs.

Upgrade nodemailer to version 8.0.5 or higher.

nodemailer is an Easy as cake e-mail sending from your Node.js applications

Affected versions of this package are vulnerable to CRLF Injection via the envelope.size parameter in the sendMail function. An attacker can inject arbitrary SMTP commands by supplying CRLF characters in the size property, which are concatenated directly into the SMTP command stream. This can result in unauthorized recipients being added to outgoing emails or other SMTP commands being executed.

Note:

This is only exploitable if the application explicitly passes a custom envelope object with a user-controlled size property to the mail sending process.

Upgrade nodemailer to version 8.0.4 or higher.

nodemailer is an Easy as cake e-mail sending from your Node.js applications

Affected versions of this package are vulnerable to Uncontrolled Recursion in the addressparser function. An attacker can cause the process to terminate immediately by sending an email address header containing deeply nested groups, separated by many :s.

Upgrade nodemailer to version 7.0.11 or higher.

nodemailer is an Easy as cake e-mail sending from your Node.js applications

Affected versions of this package are vulnerable to Interpretation Conflict due to improper handling of quoted local-parts containing @. An attacker can cause emails to be sent to unintended external recipients or bypass domain-based access controls by crafting specially formatted email addresses with quoted local-parts containing the @ character.

Upgrade nodemailer to version 7.0.7 or higher.