What’s Vulnerable › Vulnerabilities

CVE-2024-58379: nodemailer before 6.9.9 ReDoS via attachDataUrls parameter

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-31 · updated 2026-10-27
• Weakness: CWE-1333

Description

nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUrls parameter is set or processing embedded file attachments. Attackers can send specially crafted emails with malicious data URLs or embedded attachments to cause the event loop to hang and deny service.

Affected products

• nodemailer: before 6.9.9 — fixed in 6.9.9

How to fix

Upgrade to a fixed version: nodemailer 6.9.9. Check the vendor advisory for mitigations.

References

• https://github.com/nodemailer/nodemailer/security/advisories/GHSA-9h6g-pr28-7cqp
• https://www.vulncheck.com/advisories/nodemailer-before-6.9.9-redos-via-attachdataurls-parameter

Get alerted when CVE-2024-58379 or the next vulnerability affects your stack