-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability is an uncontrolled recursion flaw (CWE-674) in Nodemailer's email address parser. The root cause is the lack of a depth limit when parsing nested group addresses as defined in RFC 5322. The addressparser and _handleAddress functions in lib/addressparser/index.js form a recursive loop. An attacker can supply a specially crafted email address string with a large number of nested groups (e.g., "group1: group2: ... : user@example.com;").
When the addressparser function processes this string, it identifies the outer group and calls _handleAddress. _handleAddress then recursively calls addressparser to process the inner group's contents. This cycle repeats for each nested group. Without a limit, this recursion continues until the Node.js call stack is exhausted, causing a "Maximum call stack size exceeded" error and crashing the application, resulting in a Denial of Service.
The patch addresses this by introducing a MAX_NESTED_GROUP_DEPTH constant and adding a depth counter to the addressparser and _handleAddress functions. This ensures that the recursion stops after a safe number of iterations, preventing the stack overflow.
addressparserlib/addressparser/index.js
_handleAddresslib/addressparser/index.js
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nodemailer | npm | < 7.0.11 | 7.0.11 |