GHSA-rcmh-qjqh-p98v
High · 7.5CVSS
7.5
EPSS
—
Published
Dec 1, 2025
CISA due date
—
The record
Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | nodemailer | 0 | 7.0.11 |
| Chainguard | jitsucom-jitsu | 0 | 2.11.0-r8 |
| Chainguard | jitsucom-jitsu-console | 0 | 2.11.0-r8 |
| Chainguard | jitsucom-jitsu-rotor | 0 | 2.11.0-r8 |
| Chainguard | kibana-8.17 | 0 | 8.17.10-r4 |
| Chainguard | kibana-8.17-bitnami | 0 | 8.17.10-r4 |
| Chainguard | kibana-8.17-iamguarded | 0 | 8.17.10-r4 |
| Chainguard | kibana-8.18 | 0 | 8.18.8-r3 |
| Chainguard | kibana-8.18-bitnami | 0 | 8.18.8-r3 |
| Chainguard | kibana-8.18-iamguarded | 0 | 8.18.8-r3 |
| Chainguard | kibana-8.19 | 0 | 8.19.8-r0 |
| Chainguard | kibana-8.19-bitnami | 0 | 8.19.8-r0 |
| Chainguard | kibana-8.19-iamguarded | 0 | 8.19.8-r0 |
| Chainguard | kibana-9.0 | 0 | 9.0.8-r3 |
| Chainguard | kibana-9.0-bitnami | 0 | 9.0.8-r3 |
| Chainguard | kibana-9.0-iamguarded | 0 | 9.0.8-r3 |
| Chainguard | kibana-9.1 | 0 | 9.1.7-r2 |
| Chainguard | kibana-9.1-bitnami | 0 | 9.1.7-r2 |
| Chainguard | kibana-9.1-iamguarded | 0 | 9.1.7-r2 |
| Chainguard | langfuse-3 | 0 | 3.135.1-r2 |
| Chainguard | langfuse-3-compat | 0 | 3.135.1-r2 |
| Chainguard | langfuse-3-worker | 0 | 3.135.1-r2 |
| Chainguard | langfuse-web-3 | 0 | 3.135.1-r2 |
| Chainguard | langfuse-web-compat | 0 | 3.135.1-r2 |
| Chainguard | langfuse-worker-3 | 0 | 3.135.1-r2 |
| Chainguard | librechat | 0 | 0.8.0-r5 |
| Chainguard | librechat-compat | 0 | 0.8.0-r5 |
| Chainguard | librechat-dev | 0 | 0.8.0-r5 |
| Wolfi | jitsucom-jitsu | 0 | 2.11.0-r8 |
| Wolfi | jitsucom-jitsu-console | 0 | 2.11.0-r8 |
| Wolfi | jitsucom-jitsu-rotor | 0 | 2.11.0-r8 |
| Wolfi | langfuse-3 | 0 | 3.135.1-r2 |
| Wolfi | langfuse-3-compat | 0 | 3.135.1-r2 |
| Wolfi | langfuse-3-worker | 0 | 3.135.1-r2 |
| Wolfi | langfuse-web-3 | 0 | 3.135.1-r2 |
| Wolfi | langfuse-web-compat | 0 | 3.135.1-r2 |
| Wolfi | langfuse-worker-3 | 0 | 3.135.1-r2 |
Related vulnerabilities
- CVE-2025-14874 Nodemailer is vulnerable to DoS through Uncontrolled Recursion Same vulnerability
- GHSA-p6gq-j5cr-w38f Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess… Also affects nodemailer
- GHSA-268h-hp4c-crq3 Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message… Also affects nodemailer
- GHSA-wqvq-jvpq-h66f Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message… Also affects nodemailer
- GHSA-r7g4-qg5f-qqm2 Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential… Also affects nodemailer
- GHSA-vvjj-xcjg-gr5g Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option… Also affects nodemailer
- GHSA-c7w3-x93f-qmm8 Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameter Also affects nodemailer
- GHSA-46j5-6fg5-4gv3 Duplicate Advisory: Nodemailer is vulnerable to DoS through Uncontrolled Recursion Also affects nodemailer