Denial of Service in Nodemailer via Regex Backtracking

Executive Summary

This vulnerability is a denial-of-service issue in the Nodemailer library's addressparser component. It occurs due to quadratic backtracking in a regular expression used for parsing email headers. Attackers can exploit this by sending crafted email headers with long whitespace-free strings, causing the Node.js event loop to block for tens of seconds and making services unavailable.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the version of nodemailer in your system using 'npm list nodemailer' or 'npm list -g nodemailer'. If the version is below 10.0.6, the system is vulnerable. Monitor for unusual delays in email processing or Node.js event loop blocking during email parsing tasks.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause service unavailability by blocking the Node.js event loop for extended periods. Attackers can exploit it remotely without authentication, potentially disrupting email processing services. Systems using Nodemailer versions before 10.0.6 are at risk of prolonged downtime.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update nodemailer to version 10.0.6 or later using 'npm update nodemailer' or 'npm install nodemailer@latest'. If updating is not possible, consider disabling the free-text fallback regex parsing in email headers as a temporary workaround.

Useful 0 Not Useful 0