Description

nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUrls parameter is set or processing embedded file attachments. Attackers can send specially crafted emails with malicious data URLs or embedded attachments to cause the event loop to hang and deny service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-31T09:16:59.387Z",
  "pubdate": "2026-08-31T09:16:59.387Z",
  "executiveSummary": "Nodemailer versions prior to 6.9.9 are susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability. The flaw originates within the email parsing logic when processing embedded file attachments or when the 'attachDataUrls' parameter is enabled.\nThe vulnerability allows an unauthenticated remote attacker to trigger catastrophic backtracking within the regular expression engine. By submitting a maliciously crafted email payload, an attacker can force the Node.js event loop into a non-responsive state, effectively causing a Denial of Service (DoS) for the application.\nBecause Node.js operates on a single-threaded event loop, the excessive CPU consumption required to process the adversarial regex pattern blocks all concurrent operations, preventing the server from handling legitimate requests. This poses a significant risk to service availability for applications that rely on Nodemailer to ingest or process user-supplied email content.",
  "technicalDetails": "The root cause of this vulnerability is an inefficient regular expression pattern utilized during the parsing of email attachments and Data URLs. In scenarios where 'attachDataUrls' is enabled, the parser attempts to validate and process these URLs using regex patterns that exhibit exponential time complexity in worst-case scenarios.\nWhen the input string contains specifically crafted characters—often involving deeply nested structures or long, repeating sequences—the regex engine enters a state of catastrophic backtracking. During this process, the engine attempts to explore an exponential number of possible matches, leading to complete exhaustion of CPU resources.\nThe attack flow begins when an attacker sends an email containing a specially engineered Data URL or embedded attachment to a server running a vulnerable version of Nodemailer. Once the application receives this payload and passes it to the parser, the regex engine becomes trapped in the backtracking loop.\nBecause the event loop is blocked by this high-compute activity, the process becomes unable to fulfill its primary duties, such as network I/O, database interactions, or other incoming request processing. This results in an immediate and sustained DoS condition for the affected instance.\nThis vulnerability affects all Nodemailer versions prior to 6.9.9. The exploit does not require authentication or elevated privileges, as it is triggered during the standard parsing phase of email processing. The network exposure is broad, as any exposed endpoint that accepts email content for processing—such as webhooks, inbound email APIs, or administrative email ingestion interfaces—is potentially reachable by an attacker.\nThe post-exploitation impact is limited to availability degradation. The attacker cannot achieve remote code execution (RCE) or unauthorized data access through this specific vector; however, the simplicity of the attack makes it a highly effective tool for disrupting service stability in environments that do not employ strict input sanitization before processing email metadata."
}