Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-5w3y-3jd9-tug2
Vulnerability ID VCID-5w3y-3jd9-tug2
Aliases GHSA-9h6g-pr28-7cqp
GMS-2024-59
Summary nodemailer ReDoS when trying to send a specially crafted email A ReDoS vulnerability occurs when nodemailer tries to parse img files with the parameter `attachDataUrls` set, causing the stuck of event loop. Another flaw was found when nodemailer tries to parse an attachments with a embedded file, causing the stuck of event loop.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1333 Inefficient Regular Expression Complexity
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 5.3 https://gist.github.com/francoatmega/890dd5053375333e40c6fdbcc8c58df6
generic_textual MODERATE https://gist.github.com/francoatmega/890dd5053375333e40c6fdbcc8c58df6
cvssv3.1 5.3 https://gist.github.com/francoatmega/9aab042b0b24968d7b7039818e8b2698
generic_textual MODERATE https://gist.github.com/francoatmega/9aab042b0b24968d7b7039818e8b2698
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-9h6g-pr28-7cqp
cvssv3.1 5.3 https://github.com/nodemailer/nodemailer
generic_textual MODERATE https://github.com/nodemailer/nodemailer
cvssv3.1 5.3 https://github.com/nodemailer/nodemailer/commit/dd8f5e8a4ddc99992e31df76bcff9c590035cd4a
generic_textual MODERATE https://github.com/nodemailer/nodemailer/commit/dd8f5e8a4ddc99992e31df76bcff9c590035cd4a
cvssv3.1 5.3 https://github.com/nodemailer/nodemailer/security/advisories/GHSA-9h6g-pr28-7cqp
cvssv3.1_qr MODERATE https://github.com/nodemailer/nodemailer/security/advisories/GHSA-9h6g-pr28-7cqp
generic_textual MODERATE https://github.com/nodemailer/nodemailer/security/advisories/GHSA-9h6g-pr28-7cqp
Reference id Reference type URL
https://gist.github.com/francoatmega/890dd5053375333e40c6fdbcc8c58df6
https://gist.github.com/francoatmega/9aab042b0b24968d7b7039818e8b2698
https://github.com/nodemailer/nodemailer
https://github.com/nodemailer/nodemailer/commit/dd8f5e8a4ddc99992e31df76bcff9c590035cd4a
GHSA-9h6g-pr28-7cqp https://github.com/advisories/GHSA-9h6g-pr28-7cqp
GHSA-9h6g-pr28-7cqp https://github.com/nodemailer/nodemailer/security/advisories/GHSA-9h6g-pr28-7cqp
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://gist.github.com/francoatmega/890dd5053375333e40c6fdbcc8c58df6
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://gist.github.com/francoatmega/9aab042b0b24968d7b7039818e8b2698
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://github.com/nodemailer/nodemailer
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://github.com/nodemailer/nodemailer/commit/dd8f5e8a4ddc99992e31df76bcff9c590035cd4a
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://github.com/nodemailer/nodemailer/security/advisories/GHSA-9h6g-pr28-7cqp
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

No EPSS data available for this vulnerability.

Date Actor Action Source VulnerableCode Version
2026-06-02T04:46:57.150160+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/nodemailer/GHSA-9h6g-pr28-7cqp.yml 38.6.0