GHSA-9h6g-pr28-7cqp

What it actually does

Vulnerable nodemailer versions can enter catastrophic regular-expression backtracking while processing a specially crafted email (typically during address or header parsing on send). The Node.js event loop is blocked, so the process stops handling other work until the match times out or the process is killed. Impact is availability only: no remote code execution, authentication bypass, or data disclosure is implied by this flaw.

Why it matters to the business

Applications that send mail through nodemailer can become unresponsive, delaying or stopping transactional email, notifications, and related user flows until the worker is restarted. The issue is a moderate-severity denial of service (CVSS 5.3), is not listed in CISA KEV, has no reported exploit maturity, and is nearly three years old, so mass opportunistic exploitation is unlikely; residual risk is still material wherever untrusted mailbox data is passed to sendMail on unpatched 6.x releases.

How an attack unfolds

An attacker who can influence an email address, display name, or related header that the application later hands to nodemailer crafts input that triggers pathological regex matching. When the app calls send (or an equivalent parse-and-send path), CPU spikes and the event loop stalls, denying service to that process. No privileged access or special network protocol is required beyond the application's existing mail-sending API. There are no named threat actors or ransomware campaigns associated with this advisory.

How to fix it

Upgrade nodemailer (npm) to 6.9.9 or later in every direct and transitive dependency, then rebuild and redeploy. Confirm lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml) resolve to >= 6.9.9 and that no lingering copies of older 6.x remain in Docker images or serverless bundles. Until upgraded, avoid passing untrusted mailbox strings into sendMail and isolate mail-sending in a separate, restartable worker so a hang cannot take down the main application.

How to confirm the fix worked

Run a dependency inventory (npm ls nodemailer, yarn why nodemailer, or equivalent SBOM) and assert every installed copy is 6.9.9+. After deploy, send only benign mail through the same code paths and confirm send latency and event-loop lag stay normal. Do not use exploit payloads to prove the fix; version evidence plus healthy send behavior is sufficient.

Typical attack path

1. Find an application that uses nodemailer and accepts user-controlled mailbox fields (signup, invite, contact form, notification recipient).
2. Submit a specially crafted address or header intended to cause catastrophic backtracking in nodemailer's parsers.
3. Trigger the application's send path so the library evaluates the malicious input.
4. Observe process hang or extreme CPU as the event loop is blocked.
5. Repeat or automate submissions to keep workers unavailable.

How to detect it

This is a local ReDoS hang, not a network implant, so there are no reliable file or C2 indicators. Hunt historically for Node.js processes that spiked CPU or stopped answering health checks at the same time as outbound mail send, nodemailer/sendMail errors, or event-loop lag metrics. Review application logs around mail-send endpoints for unusually long request durations or worker timeouts without a corresponding SMTP conversation. Absence of those signals does not prove non-exploitation; it only means a hang may have looked like a generic outage.

What your security team should do

• Patch nodemailer to 6.9.9+ across all services and lockfiles as a standard dependency upgrade, not an emergency KEV response.
• Inventory npm applications that send mail and treat untrusted recipient/header input as untrusted until the upgrade is verified.
• Isolate mail-sending in bounded workers with CPU/time limits and automatic restart so a future parser hang cannot block request handling.
• Add SBOM or CI gates that fail builds still resolving nodemailer below 6.9.9.
• Track this as availability risk only; no evidence of in-the-wild exploitation or ransomware use.