CVE-2024-58379
CVE-2024-58379 · nodemailer before 6.9.9 ReDoS via attachDataUrls parameter
This page contains facts from public vulnerability sources. Check the original advisory before updating.
nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUrls parameter is set or processing embedded file attachments. Attackers can send specially crafted emails with malicious data URLs or embedded attachments to cause the event loop to hang and deny service.
CVSS 6.9 · Medium · EPSS 0.3% · Fix available
- Published
- Updated
Affected products and versions
nodemailer
- Versions
- ≥ 0, < 6.9.9: Affected (semver)
- 6.9.9: Not affected (semver)
Update to 6.9.9
node-nodemailer Debian:12
- Versions
- 10.0.0+~8.0.1-1
- 6.10.0+~6.4.17-1
- 6.8.0+~6.4.6-1
- 6.9.13+~6.4.14-1
- 6.9.15+~6.4.16-1
- 6.9.16+~6.4.16-1
- 6.9.4+~6.4.9-1
- 6.9.4+~6.4.9-2
- 6.9.4+~6.4.9-3
- 6.9.4+~6.4.9-4
- 7.0.10+~7.0.2-1
- 7.0.12+~7.0.5-1
- 7.0.5+~7.0.1-1
- 7.0.6+~7.0.1-1
- 7.0.9+~7.0.2-1
- 7.0.9+~7.0.2-2
- 8.0.11+~8.0.1-1
- 8.0.2+~7.0.11-1
- 8.0.3+~7.0.11-1
- 8.0.4+~7.0.11-1
- 8.0.4+~7.0.11-2
- 9.0.0+~8.0.1-1
- 9.0.3+~8.0.1-1
- 9.0.5+~8.0.1-1
- 9.0.6+~8.0.1-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-nodemailer Debian:13
- Affected ranges
- ECOSYSTEM: < 6.9.13+~6.4.14-1
Update to 6.9.13+~6.4.14-1
node-nodemailer Debian:14
- Affected ranges
- ECOSYSTEM: < 6.9.13+~6.4.14-1
Update to 6.9.13+~6.4.14-1
nodemailer npm
- Affected ranges
- SEMVER: < 6.9.9
Update to 6.9.9
node-nodemailer Ubuntu:20.04:LTS
- Versions
- 6.3.0-2
- 6.3.1-1
- 6.4.0-1
- 6.4.1-1
- 6.4.2-1
- 6.4.5-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-nodemailer Ubuntu:22.04:LTS
- Versions
- 6.4.17-3
- 6.7.0-1
- 6.7.0-2
- 6.7.1+~6.4.4-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-nodemailer Ubuntu:24.04:LTS
- Versions
- 6.9.4+~6.4.9-2
- 6.9.4+~6.4.9-3ubuntu1
- 6.9.4+~6.4.9-4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published