Regular Expression Denial of Service in Nodemailer by Nodemailer

CVE-2024-58379

What is CVE-2024-58379?

Nodemailer versions prior to 6.9.9 are susceptible to a regular expression denial of service vulnerability, affecting email parsing when the attachDataUrls parameter is enabled or during the processing of embedded file attachments. By sending specially crafted emails with malicious data URLs or embedded attachments, attackers can exploit this flaw to induce the event loop to become unresponsive, resulting in service disruption.

References