CVE-2025-14874: Nodemailer DoS via Crafted Email Address Header

CVE-2025-14874: How a Crafted Email Header Could Bring Down Your Nodemailer App

Introduction

The package-lock.json file in the Dise-ador-experto-master project locked a dependency on Nodemailer 6.10.1 — a version now known to contain a high-severity Denial of Service (DoS) vulnerability tracked as CVE-2025-14874. This flaw means that any application using Nodemailer 6.10.1 to process or relay email could be forced into an unresponsive state simply by receiving a maliciously crafted email address header. No authentication, no special privileges — just a carefully constructed string delivered to your application's email-handling code.

For developers building applications that send transactional emails, process inbound messages, or validate email addresses using Nodemailer, this is a critical dependency to audit immediately.

The Vulnerability Explained

What Goes Wrong in Nodemailer 6.10.1?

Nodemailer's email address header parsing logic in versions up to and including 6.10.1 contains a flaw in how it processes structured email address fields (such as To:, From:, Cc:, and Reply-To: headers). When a specially crafted string is passed as an email address — particularly one designed to exploit edge cases in the parser's tokenization or regular expression matching — the parser can enter a catastrophic backtracking loop or consume excessive CPU and memory resources before completing (or failing to complete) its work.

This class of vulnerability is sometimes called a ReDoS (Regular Expression Denial of Service) or more broadly a parser exhaustion attack. The attacker doesn't need to compromise your server, steal credentials, or find an open port — they just need to get their crafted string into a field that Nodemailer will attempt to parse.

A Concrete Attack Scenario

Imagine your application exposes an endpoint that accepts a recipient email address and sends a confirmation email:

// Vulnerable application code using Nodemailer 6.10.1
const nodemailer = require('nodemailer'); // pinned to 6.10.1

app.post('/send-confirmation', async (req, res) => {
  const { recipientEmail } = req.body;

  const transporter = nodemailer.createTransport({ /* config */ });

  await transporter.sendMail({
    from: 'no-reply@example.com',
    to: recipientEmail,  // <-- attacker-controlled input
    subject: 'Confirm your account',
    text: 'Please confirm your account.'
  });

  res.send('Email sent!');
});

An attacker submits a POST request with a recipientEmail value like:

"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa@aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaa (crafted nested comment or quoted-string payload)"

Nodemailer 6.10.1's address parser attempts to tokenize and validate this input. Due to the flaw in its parsing logic, the process becomes stuck in a near-infinite loop — consuming 100% of one CPU core and potentially exhausting the Node.js event loop. Because Node.js is single-threaded, all other requests to your application are blocked until the parser either completes or the process is killed.

A single HTTP request can effectively take your entire application offline.

Why package-lock.json Is the Smoking Gun

The package-lock.json file in Dise-ador-experto-master explicitly pinned:

"nodemailer": {
  "version": "6.10.1",
  ...
}

Lock files are designed to ensure reproducible builds — which is exactly what you want. But they also mean that a known-vulnerable version will keep being installed on every npm ci or npm install run until the lock file is updated. This is why automated dependency scanning and timely upgrades are essential parts of a secure development workflow.

The Fix

The Upgrade: Nodemailer 6.10.1 → 7.0.11

The fix applied in this pull request is a direct major version upgrade of Nodemailer:

# package-lock.json (simplified)
  "nodemailer": {
-   "version": "6.10.1",
+   "version": "7.0.11",
    "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-...",
    ...
  }

What Changed in Nodemailer 7.x?

Nodemailer 7.0.11 includes a hardened rewrite of the email address header parsing subsystem. The fix addresses the root cause by:

1. Bounding the parser's complexity — The new parser enforces limits on recursion depth and token count when processing address headers, preventing any single input from consuming unbounded resources.

2. Replacing vulnerable regex patterns — Patterns that were susceptible to catastrophic backtracking have been replaced with linear-time parsing logic that cannot be forced into exponential behavior regardless of input.

3. Stricter input validation at ingestion — Malformed or excessively long address components are now rejected early in the pipeline, before any expensive parsing work begins.

Why This Is a Major Version Bump

The jump from 6.x to 7.x signals breaking changes in Nodemailer's public API. Before upgrading in production, developers should review the Nodemailer v7 migration guide and test their transporter configurations, message options, and any custom transport plugins. The security benefit is unambiguous, but the upgrade requires deliberate testing — not just a version number change.

Key Takeaways

• Nodemailer 6.10.1's address header parser could be exploited with a single crafted string — no authentication required — to exhaust CPU and block the Node.js event loop entirely.
• The package-lock.json in Dise-ador-experto-master was the direct cause of the vulnerable version being installed — lock files preserve vulnerabilities as faithfully as they preserve stability.
• Upgrading to Nodemailer 7.0.11 is a major version change, meaning you should test your email-sending code paths thoroughly before deploying to production.
• User-supplied email addresses passed directly to Nodemailer's to/from fields without prior validation are the primary attack surface — always validate before parsing.
• Automated dependency scanning (npm audit, Dependabot) would have flagged this vulnerability before it required an emergency fix — integrate these tools into your CI pipeline now.

Conclusion

CVE-2025-14874 is a sharp reminder that email-handling libraries are not immune to Denial of Service vulnerabilities — and that a single malformed header value is all it takes to bring a Node.js application to its knees. The Dise-ador-experto-master project's reliance on Nodemailer 6.10.1, locked in package-lock.json, created a silent but serious risk for anyone running this application in a production environment where email addresses could be influenced by external users.

The fix is clear: upgrade to Nodemailer 7.0.11, validate email inputs before they reach the library, and invest in automated dependency monitoring so vulnerabilities like this are caught — and fixed — before they become incidents.

Secure your dependencies. Validate your inputs. Keep your lock files current.

This post was prepared by the Orbis AppSec team as part of our automated vulnerability remediation and security education program.