CVE-2025-14874
Fixed in a distro release EPSS <1%CVSS 7.5
A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the address parser.
Products: nodemailer, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Ceph Storage 8, Red Hat Developer Hub
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.webjars.npm:nodemailer | no fix |
| npm | nodemailer | 7.0.11 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | jitsucom-jitsu | 2.11.0-r8 |
| Chainguard | jitsucom-jitsu-console | 2.11.0-r8 |
| Chainguard | jitsucom-jitsu-rotor | 2.11.0-r8 |
| Chainguard | kibana-8.17 | 8.17.10-r4 |
| Chainguard | kibana-8.17-bitnami | 8.17.10-r4 |
| Chainguard | kibana-8.17-iamguarded | 8.17.10-r4 |
| Chainguard | kibana-8.18 | 8.18.8-r3 |
| Chainguard | kibana-8.18-bitnami | 8.18.8-r3 |
| Chainguard | kibana-8.18-iamguarded | 8.18.8-r3 |
| Chainguard | kibana-8.19 | 8.19.8-r0 |
| Chainguard | kibana-8.19-bitnami | 8.19.8-r0 |
| Chainguard | kibana-8.19-iamguarded | 8.19.8-r0 |
| Chainguard | kibana-9.0 | 9.0.8-r3 |
| Chainguard | kibana-9.0-bitnami | 9.0.8-r3 |
| Chainguard | kibana-9.0-iamguarded | 9.0.8-r3 |
| Chainguard | kibana-9.1 | 9.1.7-r2 |
| Chainguard | kibana-9.1-bitnami | 9.1.7-r2 |
| Chainguard | kibana-9.1-iamguarded | 9.1.7-r2 |
| Chainguard | langfuse-3 | 3.135.1-r2 |
| Chainguard | langfuse-3-compat | 3.135.1-r2 |
| Chainguard | langfuse-3-worker | 3.135.1-r2 |
| Chainguard | langfuse-web-3 | 3.135.1-r2 |
| Chainguard | langfuse-web-compat | 3.135.1-r2 |
| Chainguard | langfuse-worker-3 | 3.135.1-r2 |
| Chainguard | librechat | 0.8.0-r5 |
| Chainguard | librechat-compat | 0.8.0-r5 |
| Chainguard | librechat-dev | 0.8.0-r5 |
| Debian 12 | node-nodemailer | no fix |
| Debian 13 | node-nodemailer | no fix |
| Debian 14 | node-nodemailer | 7.0.12+~7.0.5-1 |
| Ubuntu 20.04 LTS | node-nodemailer | no fix |
| Ubuntu 22.04 LTS | node-nodemailer | no fix |
| Ubuntu 24.04 LTS | node-nodemailer | no fix |
| Ubuntu 25.10 | node-nodemailer | no fix |
| Ubuntu 26.04 LTS | node-nodemailer | no fix |
| Ubuntu 26.10 | node-nodemailer | no fix |
| Wolfi | jitsucom-jitsu | 2.11.0-r8 |
| Wolfi | jitsucom-jitsu-console | 2.11.0-r8 |
| Wolfi | jitsucom-jitsu-rotor | 2.11.0-r8 |
| Wolfi | langfuse-3 | 3.135.1-r2 |
| Wolfi | langfuse-3-compat | 3.135.1-r2 |
| Wolfi | langfuse-3-worker | 3.135.1-r2 |
| Wolfi | langfuse-web-3 | 3.135.1-r2 |
| Wolfi | langfuse-web-compat | 3.135.1-r2 |
| Wolfi | langfuse-worker-3 | 3.135.1-r2 |