Vulnerability-Lookup

ubuntu-cve-2025-14874

Vulnerability from osv_ubuntu

Published

2025-12-18 09:15

Modified

2026-05-20 15:16

Summary

Details

A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the address parser.

Severity

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2025-14874	REPORT
	https://www.cve.org/CVERecord?id=CVE-2025-14874	REPORT
	https://github.com/nodemailer/nodemailer/security…	REPORT
	https://access.redhat.com/security/cve/CVE-2025-14874	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2418133	REPORT
	https://github.com/nodemailer/nodemailer	REPORT
	https://github.com/nodemailer/nodemailer/commit/b…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "node-nodemailer",
            "binary_version": "6.4.5-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "node-nodemailer",
        "purl": "pkg:deb/ubuntu/node-nodemailer@6.4.5-1?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "6.3.0-2",
        "6.3.1-1",
        "6.4.0-1",
        "6.4.1-1",
        "6.4.2-1",
        "6.4.5-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "node-nodemailer",
            "binary_version": "6.7.1+~6.4.4-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "node-nodemailer",
        "purl": "pkg:deb/ubuntu/node-nodemailer@6.7.1+~6.4.4-1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "6.4.17-3",
        "6.7.0-1",
        "6.7.0-2",
        "6.7.1+~6.4.4-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "node-nodemailer",
            "binary_version": "6.9.4+~6.4.9-4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "node-nodemailer",
        "purl": "pkg:deb/ubuntu/node-nodemailer@6.9.4+~6.4.9-4?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "6.9.4+~6.4.9-2",
        "6.9.4+~6.4.9-3ubuntu1",
        "6.9.4+~6.4.9-4"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "node-nodemailer",
            "binary_version": "7.0.5+~7.0.1-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "node-nodemailer",
        "purl": "pkg:deb/ubuntu/node-nodemailer@7.0.5+~7.0.1-1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "6.10.0+~6.4.17-1",
        "7.0.5+~7.0.1-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "node-nodemailer",
            "binary_version": "8.0.4+~7.0.11-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "node-nodemailer",
        "purl": "pkg:deb/ubuntu/node-nodemailer@8.0.4+~7.0.11-1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.0.5+~7.0.1-1",
        "7.0.9+~7.0.2-2",
        "7.0.10+~7.0.2-1",
        "7.0.12+~7.0.5-1",
        "8.0.4+~7.0.11-1"
      ]
    }
  ],
  "aliases": [],
  "details": "A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the address parser.",
  "id": "UBUNTU-CVE-2025-14874",
  "modified": "2026-05-20T15:16:04Z",
  "published": "2025-12-18T09:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-14874"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-14874"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/nodemailer/nodemailer/security/advisories/GHSA-rcmh-qjqh-p98v"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-14874"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418133"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/nodemailer/nodemailer"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/nodemailer/nodemailer/commit/b61b9c0cfd682b6f647754ca338373b68336a150"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2025-14874"
  ]
}

CVE-2025-14874 (GCVE-0-2025-14874)

Vulnerability from cvelistv5 – Published: 2025-12-18 08:40 – Updated: 2026-01-08 02:59

Title

Nodemailer: nodemailer: denial of service via crafted email address header

Summary

A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the address parser.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-703 - Improper Check or Handling of Exceptional Conditions

Assigner

redhat

References

5 references

URL	Tags
https://access.redhat.com/security/cve/CVE-2025-14874	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2418133	issue-trackingx_refsource_REDHAT
https://github.com/nodemailer/nodemailer
https://github.com/nodemailer/nodemailer/commit/b…
https://github.com/nodemailer/nodemailer/security…

Impacted products

4 products

Vendor	Product	Version
nodemailer	nodemailer	Affected: 0 , < 7.0.11 (semver)
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2	cpe:/a:redhat:acm:2
Red Hat	Red Hat Ceph Storage 8	cpe:/a:redhat:ceph_storage:8
Red Hat	Red Hat Developer Hub	cpe:/a:redhat:rhdh:1

Date Public

2025-12-01 20:44

Credits

Red Hat would like to thank uko3211 for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-14874",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-18T14:32:42.747682Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-18T14:32:56.024Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/nodemailer/nodemailer/security/advisories/GHSA-rcmh-qjqh-p98v"
          },
          {
            "tags": [
              "exploit"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418133"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/nodemailer/nodemailer",
          "defaultStatus": "unaffected",
          "packageName": "nodemailer",
          "product": "nodemailer",
          "vendor": "nodemailer",
          "versions": [
            {
              "lessThan": "7.0.11",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:acm:2"
          ],
          "defaultStatus": "affected",
          "packageName": "rhacm2/acm-grafana-rhel9",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:ceph_storage:8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhceph/grafana-rhel9",
          "product": "Red Hat Ceph Storage 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhdh:1"
          ],
          "defaultStatus": "affected",
          "packageName": "rhdh/rhdh-hub-rhel9",
          "product": "Red Hat Developer Hub",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank uko3211 for reporting this issue."
        }
      ],
      "datePublic": "2025-12-01T20:44:25.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the address parser."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-703",
              "description": "Improper Check or Handling of Exceptional Conditions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-08T02:59:52.145Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2025-14874"
        },
        {
          "name": "RHBZ#2418133",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418133"
        },
        {
          "url": "https://github.com/nodemailer/nodemailer"
        },
        {
          "url": "https://github.com/nodemailer/nodemailer/commit/b61b9c0cfd682b6f647754ca338373b68336a150"
        },
        {
          "url": "https://github.com/nodemailer/nodemailer/security/advisories/GHSA-rcmh-qjqh-p98v"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-12-01T22:06:37.176Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2025-12-01T20:44:25.000Z",
          "value": "Made public."
        }
      ],
      "title": "Nodemailer: nodemailer: denial of service via crafted email address header",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-703: Improper Check or Handling of Exceptional Conditions"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2025-14874",
    "datePublished": "2025-12-18T08:40:31.916Z",
    "dateReserved": "2025-12-18T06:54:04.556Z",
    "dateUpdated": "2026-01-08T02:59:52.145Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

ubuntu-cve-2025-14874

Vulnerability from osv_ubuntu

CVE-2025-14874 (GCVE-0-2025-14874)

Tags

Sightings

Nomenclature