Description (CNA)
Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or man-in-the-middle SMTP server can reply to EHLO with 250-AUTH, a long whitespace run and a non-matching token, blocking the Node.js event loop for tens of seconds to hours before authentication.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| nodemailer / nodemailer | affected 3.0.0 before 10.0.13; unaffected 10.0.13 |
CWE
CWE-1333
References
- https://github.com/nodemailer/nodemailer/security/advisories/GHSA-4ffr-jq9g-5ffx
- https://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.0.13-redos-via-smtp-auth-mechanism-detection-regexes
ADP enrichment
No English description supplied.