CVE-2025-14874: Nodemailer DoS Vulnerability

CVE-2025-14874 Overview

A denial of service vulnerability was discovered in Nodemailer, a popular Node.js email sending library. This vulnerability allows attackers to trigger infinite recursion in the address parser by sending crafted email address headers, leading to stack overflow and application crash. The flaw resides in the address parsing functionality, which fails to properly handle deeply nested group structures in email addresses.

Critical Impact

Remote attackers can crash Node.js applications using Nodemailer by sending malformed email address headers, causing service disruption without requiring authentication.

Affected Products

• Nodemailer for Node.js (all versions prior to the security patch)
• Red Hat Advanced Cluster Management for Kubernetes 2.0
• Red Hat Ceph Storage 8.0
• Red Hat Developer Hub

Discovery Timeline

• 2025-12-18 - CVE-2025-14874 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-14874

Vulnerability Analysis

This vulnerability is classified under CWE-703 (Improper Check or Handling of Exceptional Conditions). The flaw exists in Nodemailer's address parser component, specifically in the _handleAddress function within lib/addressparser/index.js. When processing email address headers containing deeply nested groups, the parser recursively processes these structures without any depth limit, leading to stack exhaustion.

The attack can be executed remotely over the network without requiring any authentication or user interaction. An attacker simply needs to send a crafted email with malicious address headers to an application that uses Nodemailer to process or forward emails. The infinite recursion causes the Node.js process to exceed its call stack limit, resulting in an unrecoverable crash.

Root Cause

The root cause is the absence of recursion depth tracking in the address parsing logic. The _handleAddress function processes nested email address groups by recursively calling itself, but without any mechanism to limit the depth of recursion. Email address headers in RFC 5322 format allow groups (e.g., Group Name: address1, address2;), and these groups can theoretically be nested. Malicious input exploiting this lack of depth checking can cause unbounded recursion.

Attack Vector

The attack vector is network-based, requiring an attacker to send a specially crafted email address header to a vulnerable Nodemailer instance. This could occur in scenarios where:

1. A web application accepts user-provided email addresses for sending notifications
2. An email processing service parses incoming messages using Nodemailer
3. An API endpoint that handles email composition is exposed

The security patch introduces a depth parameter to the _handleAddress function to track and limit recursion depth:

  * Converts tokens for a single address into an address object
  *
  * @param {Array} tokens Tokens object
+ * @param {Number} depth Current recursion depth for nested group protection
  * @return {Object} Address object
  */
-function _handleAddress(tokens) {
+function _handleAddress(tokens, depth) {
     let isGroup = false;
     let state = 'text';
     let address;

Source: GitHub Nodemailer Commit

Detection Methods for CVE-2025-14874

Indicators of Compromise

• Unexpected Node.js process crashes with "RangeError: Maximum call stack size exceeded" errors
• Application logs showing repeated address parsing operations before crash
• Incoming emails or API requests with unusually complex or deeply nested address headers
• Elevated memory usage in Node.js processes handling email operations

Detection Strategies

• Monitor Node.js application logs for stack overflow errors related to address parsing
• Implement application performance monitoring (APM) to detect sudden process terminations
• Review incoming email headers for anomalous nesting patterns in address fields
• Use SentinelOne's runtime protection to detect abnormal recursion patterns in monitored applications

Monitoring Recommendations

• Configure alerting for Node.js process crashes in production environments
• Set up log aggregation to correlate email processing events with application failures
• Monitor network traffic for unusual patterns in SMTP communications
• Implement health checks that verify Nodemailer-dependent services remain responsive

How to Mitigate CVE-2025-14874

Immediate Actions Required

• Update Nodemailer to the latest patched version immediately
• Review and restrict untrusted input to email address fields in your applications
• Implement input validation to reject excessively complex email address headers
• Consider temporarily disabling email functionality if immediate patching is not possible

Patch Information

The vulnerability has been addressed in a security patch committed to the Nodemailer repository. The fix introduces recursion depth tracking to prevent stack overflow attacks. Apply the patch by updating to the latest version of Nodemailer via npm:

• GitHub Security Advisory GHSA-rcmh-qjqh-p98v
• Security Patch Commit

For Red Hat products, consult the Red Hat CVE-2025-14874 Advisory for distribution-specific update instructions.

Workarounds

• Implement a proxy layer that sanitizes email address headers before they reach Nodemailer
• Add application-level validation to reject email addresses with excessive group nesting
• Configure process managers like PM2 to automatically restart crashed Node.js instances
• Deploy rate limiting on email-processing endpoints to slow potential exploitation attempts

# Update Nodemailer to the latest patched version
npm update nodemailer

# Verify installed version
npm list nodemailer

# If using yarn
yarn upgrade nodemailer