Nodemailer versions from 3.0.0 up to but not including 10.0.13 contain a vulnerability in the SMTP client where certain regular expressions used to detect SMTP AUTH mechanisms cause quadratic backtracking. This leads to a denial of service by blocking the Node.js event loop during the EHLO response parsing if the server returns a crafted response with long whitespace runs and no matching mechanism. The vulnerability can be triggered pre-authentication by an attacker controlling or influencing the SMTP server or man-in-the-middling the connection before STARTTLS. A fix is available in Nodemailer version 10.0.13.
Nodemailer has a vulnerability in its address parser where RFC 5322 comments inside angle-bracket email addresses are not stripped. This causes the comment text and parentheses to be included verbatim in the parsed address, leading to malformed SMTP commands that are rejected by mail servers. The issue affects versions from 3.0.0 up to but not including 10.0.13 and is distinct from previously patched comment handling bugs. A fix is available in version 10.0.13.
Nodemailer SMTP client versions from 3.0.0 up to but not including 10.0.10 contain a vulnerability in the SMTP response parser that allows a malicious or compromised SMTP server to cause a denial of service by sending a large number of continuation lines without a completion line. This triggers quadratic CPU usage in the Node.js event loop, freezing the entire process before authentication occurs. The vulnerability is fixed in version 10.0.10.
Nodemailer versions from 3.0.0 up to but not including 10.0.10 contain a denial of service vulnerability in the MessageParser.parseHeaders function. This flaw allows attackers to exhaust CPU resources by supplying large recipient lists or headers that unfold into tens of thousands of continuation lines, causing quadratic header unfolding. The attack blocks the Node.js event loop during DKIM signing, resulting in service disruption.
Nodemailer versions from 3.0.0 up to but not including 10.0.13 have an improper input validation vulnerability in the address parser. This flaw allows RFC 5322 comments inside angle-bracket email addresses to remain unstripped, enabling attackers to craft recipient addresses with parenthesized comments in the domain part. Such malformed addresses can cause delivery rejection or parser conflicts that may bypass domain allow-lists. The issue is fixed in version 10.0.13.
Nodemailer versions up to 10.0.1 improperly handle deeply nested recipient arrays in fields like to, cc, and bcc. This flaw causes a stack exhaustion denial-of-service (DoS) when processing such inputs, leading to a RangeError and potential termination of the Node.js process. The vulnerability arises because only the outermost array is flattened before passing nested arrays to a parser that converts them to strings recursively, exhausting the V8 call stack. No SMTP server or successful email delivery is required to trigger this. The issue is fixed in version 10.0.2.
Nodemailer versions from 5.0.0 up to 10.0.1 have a vulnerability in their process-global DNS cache that causes TLS server name indication (SNI) to be reused incorrectly across SMTP transports. This flaw allows one tenant in a multi-tenant environment to cause another tenant's SMTP transport to use the attacker's TLS server name and certificate, leading to potential SMTP credential disclosure. The issue arises because the DNS cache key is only the host, but the cached value includes the TLS server name, which is overwritten and reused improperly. No official patch was available at the time of this report.
Nodemailer versions 5.0.0 through 10.0.1 have a vulnerability in their DNS caching mechanism where the cache key is only the DNS host, but cache entries also store a caller-specific TLS servername. This causes the wrong SNI value to be sent when multiple TLS transports resolve the same host with different servernames, leading to incorrect certificate validation. An attacker able to prime the cache can cause a victim to connect to the attacker's TLS host and accept a malicious certificate, potentially exposing SMTP credentials. The issue is fixed in Nodemailer version 10.0.2.
Nodemailer versions before 10.0.2 have a vulnerability where deeply nested arrays in recipient fields (to, cc, bcc) are not properly flattened. This allows attackers to supply deeply nested JSON recipient arrays that cause recursive Array.toString() calls, leading to stack exhaustion and termination of the Node.js process. The vulnerability has a medium severity with a CVSS score of 5.9 and affects several specific versions including 6.3.0-2 through 6.7.0-2 and all versions prior to 10.0.2.
Nodemailer versions before 10.0.6 contain a denial of service vulnerability caused by a regex pattern in the addressparser free-text fallback. This vulnerability results in quadratic backtracking when processing crafted email header values with long whitespace-free runs, which can block the Node.js event loop and cause service unavailability.
Nodemailer versions from 9.1.0 up to but not including 10.0.9 have a vulnerability in the address parser. This flaw mishandles email addresses with quoted local-parts followed by RFC 5322 comments, causing trailing comment-separated domain atoms to remain in the normalized address. This can lead to malformed recipient addresses in the SMTP envelope. The issue is fixed in Nodemailer version 10.0.9.
Nodemailer (npm package `nodemailer`) versions 9.1.0 and earlier do not honor the `disableFileAccess` and `disableUrlAccess` sandbox options when message content is resolved through the public plugin API `MailMessage.resolveContent()` using the documented legacy three-argument signature `resolveContent(data, key, callback)`. Because `shared.resolveContent()` normalizes the missing `options` argument to an empty object, the message-level flags copied into `mail.data` by the MailMessage constructor are discarded, and `resolveContentValue()` skips both access-control checks, reaching `nmfetch(url)` or `fs.createReadStream(path)`. As a result, plugin or application code that resolves untrusted message content (html, text, attachment `path` or `href`) via this API can be induced to read arbitrary local files or issue outbound HTTP(S) requests (server-side request forgery), bypassing the sandbox the application enabled. The internal paths used by `transporter.sendMail()` (`resolveAll()`, `_convertDataImages()`, and the MIME streaming path) are not affected. Fixed in version 9.1.1.
Nodemailer versions >= 6.9.16 and < 9.1.0 mis-parse RFC 5322 comments in email addresses: in lib/addressparser, a comment closed immediately before a non-break character causes the tokenizer to concatenate the atoms surrounding the comment instead of treating the comment as folding whitespace that terminates the domain. A recipient address such as user@good-corp.com(x)evil.com is therefore read by Nodemailer as the single domain good-corp.comevil.com (registrable domain comevil.com, which an attacker can register) and used for both the SMTP envelope (RCPT TO) and the emitted To:/From: headers, while a conformant RFC 5322 parser terminates the domain at the comment and reads good-corp.com. An application that validates the recipient domain with a strict RFC 5322 parser (without inspecting parse defects) or a naive prefix/substring allow-list and then hands the raw address to Nodemailer can be induced to deliver mail to a domain the attacker controls. Fixed in 9.1.0.
Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings that pass domain allow-list checks but are delivered to attacker-controlled domains via SMTP.
Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows remote attackers to cause denial of service by supplying a crafted comma-separated address list. Attackers can send a single email with a large number of addresses to block the Node.js event loop for extended periods, consuming 100% CPU and freezing the process.
Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope object with a size property containing CRLF characters to sendMail(), the value is concatenated into the SMTP MAIL FROM command (as SIZE=...) without sanitization, allowing injection of arbitrary SMTP commands such as RCPT TO to silently add attacker-controlled recipients. Exploitation requires the application to expose the envelope size to attacker-controlled input, as Nodemailer does not include size in the default auto-constructed envelope.
A regular expression denial of service (ReDoS) vulnerability exists in nodemailer versions before 6.9.9. This flaw occurs during email parsing when the attachDataUrls parameter is enabled or when processing embedded file attachments. An attacker can exploit this by sending specially crafted emails containing malicious data URLs or embedded attachments, causing the event loop to hang and resulting in a denial of service.