CVE-2025-14874

HIGH7.5

Description

A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the address parser.

CVSS breakdown

CVSS 3.1

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected products

nodemailer / nodemailer0 – 7.0.11
nodemailer / nodemailer7.0.11
RedHat / advanced_cluster_management_for_kubernetes2.0 – 2.0
RedHat / ceph_storage8.0 – 8.0
RedHat / developer_hub

References

VENDOR_ADVISORYhttps://access.redhat.com/security/cve/CVE-2025-14874
MISChttps://bugzilla.redhat.com/show_bug.cgi?id=2418133
MISChttps://github.com/nodemailer/nodemailer
PATCHhttps://github.com/nodemailer/nodemailer/commit/b61b9c0cfd682b6f647754ca338373b68336a150
VENDOR_ADVISORYhttps://github.com/nodemailer/nodemailer/security/advisories/GHSA-rcmh-qjqh-p98v

Updated 21m ago · 8 sources