CVE-2024-58379
Fixed in a distro release EPSS <1%CVSS 5.3
nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUrls parameter is set or processing embedded file attachments. Attackers can send specially crafted emails with malicious data URLs or embedded attachments to cause the event loop to hang and deny service.
Products: nodemailer
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | nodemailer | 6.9.9 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | node-nodemailer | no fix |
| Debian 13 | node-nodemailer | 6.9.13+~6.4.14-1 |
| Debian 14 | node-nodemailer | 6.9.13+~6.4.14-1 |
| Ubuntu 20.04 LTS | node-nodemailer | no fix |
| Ubuntu 22.04 LTS | node-nodemailer | no fix |
| Ubuntu 24.04 LTS | node-nodemailer | no fix |