CVE-2024-58379 Overview
CVE-2024-58379 is a regular expression denial of service (ReDoS) vulnerability in Nodemailer versions before 6.9.9. The flaw exists in the email parsing logic when the attachDataUrls parameter is enabled or when the library processes embedded file attachments. Attackers can submit specially crafted emails containing malicious data URLs or embedded attachments to trigger catastrophic backtracking in the vulnerable regular expression. The result is a hang in the Node.js event loop, blocking legitimate email processing and denying service to dependent applications. The issue is tracked under CWE-1333 (Inefficient Regular Expression Complexity).
Critical Impact
Remote, unauthenticated attackers can stall the Node.js event loop by sending crafted email payloads, degrading availability of any service that uses Nodemailer for outbound mail.
Affected Products
- Nodemailer versions prior to 6.9.9
- Node.js applications invoking Nodemailer with attachDataUrls enabled
- Node.js applications processing untrusted embedded file attachments through Nodemailer
Discovery Timeline
- 2026-08-31 - CVE-2024-58379 published to NVD
- 2026-08-31 - Last updated in NVD database
Technical Details for CVE-2024-58379
Vulnerability Analysis
Nodemailer is a widely deployed Node.js library used to send email from server-side applications. The vulnerable code path parses attachment content, including inline data URLs supplied through the attachDataUrls option. A regular expression used during this parsing exhibits worst-case exponential complexity when fed crafted input. When an attacker controls the attachment content or headers, they can force the regex engine into extensive backtracking. Because Node.js runs on a single-threaded event loop, this backtracking blocks all other request handling in the process. Sustained or repeated inputs can render the service unresponsive without requiring authentication or user interaction.
Root Cause
The root cause is inefficient regular expression complexity ([CWE-1333]) in the routine that extracts and validates data URL structures and embedded attachment metadata. The pattern lacks anchoring or possessive constructs, allowing nested quantifier ambiguity that produces exponential match attempts on adversarial input.
Attack Vector
Exploitation is remote and network-based. An attacker submits an email payload, form submission, or API request that reaches an application invoking Nodemailer with attacker-influenced attachment data. No credentials are required when the calling application exposes an unauthenticated mail-sending endpoint. Successful exploitation exhausts CPU time in the event loop and produces availability loss for the affected process.
No public proof-of-concept has been released. Refer to the GitHub Security Advisory GHSA-9h6g-pr28-7cqp and the VulnCheck Advisory for Nodemailer for additional technical context.
Detection Methods for CVE-2024-58379
Indicators of Compromise
- Node.js processes showing sustained 100% CPU utilization on a single core while handling mail-related requests.
- Elongated request latencies or timeouts on endpoints that accept attachments or invoke Nodemailer.
- Inbound requests containing oversized or malformed data: URIs targeting mail-submission endpoints.
Detection Strategies
- Inventory Node.js dependencies with npm ls nodemailer and flag any version below 6.9.9.
- Instrument the event loop with libraries such as perf_hooks to detect blocking durations exceeding normal baselines.
- Inspect application logs for repeated slow request patterns correlated with attachment or data URL processing.
Monitoring Recommendations
- Alert on abnormal CPU saturation and event loop lag in services that call nodemailer.sendMail.
- Log and rate-limit endpoints that accept user-supplied attachment content or inline data URLs.
- Track outbound mail queue depth to detect processing stalls caused by hung worker processes.
How to Mitigate CVE-2024-58379
Immediate Actions Required
- Upgrade Nodemailer to version 6.9.9 or later across all Node.js applications.
- Audit code paths that pass attachDataUrls: true or forward untrusted attachment payloads into Nodemailer.
- Deploy request size limits and input validation on endpoints that build email attachments from client input.
Patch Information
The fix is available in Nodemailer 6.9.9 and later releases. Update the dependency in package.json and rebuild the application. Details are documented in the GitHub Security Advisory GHSA-9h6g-pr28-7cqp.
Workarounds
- Disable the attachDataUrls option unless it is strictly required by application logic.
- Reject or sanitize inbound data: URIs and enforce maximum attachment sizes before passing content to Nodemailer.
- Isolate mail-sending logic in a separate worker process so that event loop hangs do not impact primary request handling.
# Configuration example
npm install nodemailer@^6.9.9
npm ls nodemailer
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
