nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUrls parameter is set or… (CVE-2024-58379)

CVE-2024-58379 is a regular expression denial of service vulnerability in Nodemailer prior to version 6.9.9. It occurs during email parsing when the attachDataUrls parameter is set or when processing embedded file attachments. Attackers can exploit this by sending maliciously crafted emails containing data URLs or embedded attachments that trigger excessive backtracking in regular expressions, causing the Node.js event loop to hang and deny service. The vulnerability is classified under CWE-1333 and has a CVSS v3.1 score of 5.3 (medium severity). There are no known exploits in the wild and no patch links are currently provided.

The vulnerability impacts availability by causing the Node.js event loop to hang, resulting in denial of service. There is no impact on confidentiality or integrity. This can disrupt email processing services that use vulnerable versions of Nodemailer with the affected features enabled.

A fixed version 6.9.9 or later should be used to remediate this vulnerability. Since no patch links are provided in the data, users should monitor the official Nodemailer repository or vendor advisories for the release of the fix. Until patched, disabling the attachDataUrls parameter or avoiding processing embedded file attachments may reduce exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.