GHSA-46j5-6fg5-4gv3
Medium · 5.3CVSS
5.3
EPSS
—
Published
Dec 18, 2025
CISA due date
—
The record
Duplicate Advisory: Nodemailer is vulnerable to DoS through Uncontrolled Recursion
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | nodemailer | 0 | 7.0.11 |
Related vulnerabilities
- CVE-2025-14874 Nodemailer is vulnerable to DoS through Uncontrolled Recursion Same vulnerability
- GHSA-p6gq-j5cr-w38f Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess… Also affects nodemailer
- GHSA-268h-hp4c-crq3 Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message… Also affects nodemailer
- GHSA-wqvq-jvpq-h66f Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message… Also affects nodemailer
- GHSA-r7g4-qg5f-qqm2 Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential… Also affects nodemailer
- GHSA-vvjj-xcjg-gr5g Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option… Also affects nodemailer
- GHSA-c7w3-x93f-qmm8 Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameter Also affects nodemailer
- GHSA-rcmh-qjqh-p98v Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls Also affects nodemailer