Description
nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUrls parameter is set or processing embedded file attachments. Attackers can send specially crafted emails with malicious data URLs or embedded attachments to cause the event loop to hang and deny service.
Published: 2026-08-31
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 31 Aug 2026 09:00:00 +0000

Type Values Removed Values Added
Description nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUrls parameter is set or processing embedded file attachments. Attackers can send specially crafted emails with malicious data URLs or embedded attachments to cause the event loop to hang and deny service.
Title nodemailer before 6.9.9 ReDoS via attachDataUrls parameter
First Time appeared Nodemailer
Nodemailer nodemailer
Weaknesses CWE-1333
CPEs cpe:2.3:a:nodemailer:nodemailer:*:*:*:*:*:*:*:*
Vendors & Products Nodemailer
Nodemailer nodemailer
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Nodemailer Nodemailer
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-31T08:46:24.228Z

Reserved: 2026-08-16T13:02:14.690Z

Link: CVE-2024-58379

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-31T09:16:59.387

Modified: 2026-08-31T09:16:59.387

Link: CVE-2024-58379

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-1333

    Inefficient Regular Expression Complexity