Nodemailer versions earlier than 6.9.9 contain a regular expression denial of service condition in the email parsing logic when the attachDataUrls option is enabled or when processing embedded file attachments that contain data URLs. A crafted email containing malicious data URLs or specially formatted attachments can trigger exponential backtracking in the regex engine, causing the event loop to block indefinitely and resulting in a denial of service. The vulnerability is classified as CWE‑1333 and is limited to service availability; it does not directly lead to unauthorized data disclosure or code execution.

The affected product is the Nodemailer library for all platforms where it is used as an e‑mail transport. Any installation that relies on a Nodemailer version prior to 6.9.9 is susceptible to the vulnerability, regardless of the host operating system.

The CVSS score of 6.9 indicates medium severity. No specific privileges are mentioned in the CVE description; the analysis infers that the attacker does not need elevated privileges, but this conclusion is not explicitly stated by the vendor. The exploit requires only that the vulnerable system process crafted e‑mail content, so its success depends on how the mail transport receives external input. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. In environments where Nodemailer parses untrusted e‑mail data, an attacker could cause sustained blocking of the event loop, potentially degrading or halting other services that run in the same Node.js process.