CVE-2024-58379
Received Received - Intake

Regular Expression DoS in Nodemailer Email Parsing

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: VulnCheck

Description
nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUrls parameter is set or processing embedded file attachments. Attackers can send specially crafted emails with malicious data URLs or embedded attachments to cause the event loop to hang and deny service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2024-58379
EUVD
EUVD-2024-55736

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nodemailer nodemailer to 6.9.9 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1333 The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Regular Expression Denial of Service (ReDoS) vulnerability in nodemailer versions before 6.9.9. It occurs when the attachDataUrls parameter is enabled or when processing embedded file attachments. Attackers can send specially crafted emails with malicious data URLs or attachments that cause the event loop to hang, denying service to legitimate users.

Detection Guidance

To detect this vulnerability, check the installed version of nodemailer using 'npm list nodemailer' or 'npm list -g nodemailer'. If the version is below 6.9.9, the system is vulnerable.

Impact Analysis

If you use nodemailer versions before 6.9.9, an attacker could send a malicious email that causes your application to hang or crash, disrupting email processing and potentially affecting service availability. This could lead to downtime or degraded performance for your email-related services.

Mitigation Strategies

Immediately update nodemailer to version 6.9.9 or later using 'npm update nodemailer' or 'npm install nodemailer@latest'. Disable the attachDataUrls parameter if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2024-58379. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart