7.5High
CVE-2025-14874Nodemailer: nodemailer: denial of service via crafted email address header
Description
A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the address parser.
Weakness (CWE):
CWE-703
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| nodemailer | nodemailer | < 7.0.11 | |
| redhat | advanced cluster management for kubernetes | 2.0 | |
| redhat | ceph storage | 8.0 | |
| redhat | developer hub | — | |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | all versions | |
| Red Hat | Red Hat Ceph Storage 8 | all versions | |
| Red Hat | Red Hat Developer Hub 1 | all versions |
References and patches
- https://access.redhat.com/security/cve/CVE-2025-14874 vdb-entryThird Party Advisory
- RHBZ#2418133 issue-trackingExploitIssue TrackingThird Party Advisory
- https://github.com/nodemailer/nodemailer Product
- https://github.com/nodemailer/nodemailer/commit/b61b9c0cfd682b6f647754ca338373b68336a150 Patch
- https://github.com/nodemailer/nodemailer/security/advisories/GHSA-rcmh-qjqh-p98v ExploitVendor Advisory
CPE matches (NVD) (4)
cpe:2.3:a:nodemailer:nodemailer:*:*:*:*:*:node.js:*:*< 7.0.11cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:2.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:ceph_storage:8.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:developer_hub:-:*:*:*:*:*:*:*