CVE-2024-58379: nodemailer before 6.9.9 ReDoS via attachDataUrls parameter
nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUrls parameter is set or processing embedded file attachments. Attackers can send specially crafted emails with malicious data URLs or embedded attachments to cause the event loop to hang and deny service.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using nodemailer versions before 6.9.9 are affected when they enable the attachDataUrls parameter or process emails containing embedded file attachments. Systems that do neither are not identified as affected by the provided information.
What does an attacker need to do to trigger the denial of service?
An attacker needs to send a specially crafted email containing malicious data URLs or embedded attachments. No authentication or user interaction is required according to the supplied severity vector.
What is the practical impact of successful exploitation?
Processing the crafted message can cause the Node.js event loop to hang, resulting in denial of service. The provided information indicates no confidentiality or integrity impact.
How can exposure be reduced before upgrading?
Avoid enabling attachDataUrls and avoid processing untrusted emails with embedded file attachments where operationally possible. Upgrade nodemailer to version 6.9.9 or later when patching is available.