CVE-2025-14874

A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the address parser.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2025-14874	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2418133	Exploit Issue Tracking Third Party Advisory
https://github.com/nodemailer/nodemailer	Product
https://github.com/nodemailer/nodemailer/commit/b61b9c0cfd682b6f647754ca338373b68336a150	Patch
https://github.com/nodemailer/nodemailer/security/advisories/GHSA-rcmh-qjqh-p98v	Exploit Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2418133	Exploit Issue Tracking Third Party Advisory
https://github.com/nodemailer/nodemailer/security/advisories/GHSA-rcmh-qjqh-p98v	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nodemailer:nodemailer:*:*:*:*:*:node.js:*:*

Configuration 2 (hide)

OR	cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:2.0:::::::*
	cpe:2.3:a:redhat:ceph_storage:8.0:::::::*
	cpe:2.3:a:redhat:developer_hub:-:::::::*

History

30 Sep 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Se encontró una falla en Nodemailer. Esta vulnerabilidad permite una denegación de servicio (DoS) mediante un encabezado de dirección de correo electrónico manipulado que desencadena una recursión infinita en el analizador de direcciones.

Information

Published : 2025-12-18 09:15

Updated : 2026-10-27 05:16

NVD link : CVE-2025-14874

Mitre link : CVE-2025-14874

CVE.ORG link : CVE-2025-14874

JSON object : View

Products Affected

redhat

advanced_cluster_management_for_kubernetes
developer_hub
ceph_storage

nodemailer

nodemailer

CWE

CWE-703

Improper Check or Handling of Exceptional Conditions

{"id": "CVE-2025-14874", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14874", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-18T14:32:42.747682Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"vendor": "nodemailer", "product": "nodemailer", "versions": [{"status": "affected", "version": "0", "lessThan": "7.0.11", "versionType": "semver"}], "packageName": "nodemailer", "collectionURL": "https://github.com/nodemailer/nodemailer", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:acm:2"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2", "packageName": "rhacm2/acm-grafana-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:ceph_storage:8"], "vendor": "Red Hat", "product": "Red Hat Ceph Storage 8", "packageName": "rhceph/grafana-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhdh:1"], "vendor": "Red Hat", "product": "Red Hat Developer Hub 1", "packageName": "rhdh/rhdh-hub-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}]}], "published": "2025-12-18T09:15:44.870", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2025-14874", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418133", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://github.com/nodemailer/nodemailer", "tags": ["Product"], "source": "secalert@redhat.com"}, {"url": "https://github.com/nodemailer/nodemailer/commit/b61b9c0cfd682b6f647754ca338373b68336a150", "tags": ["Patch"], "source": "secalert@redhat.com"}, {"url": "https://github.com/nodemailer/nodemailer/security/advisories/GHSA-rcmh-qjqh-p98v", "tags": ["Exploit", "Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418133", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}, {"url": "https://github.com/nodemailer/nodemailer/security/advisories/GHSA-rcmh-qjqh-p98v", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-703"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the address parser."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en Nodemailer. Esta vulnerabilidad permite una denegaci\u00f3n de servicio (DoS) mediante un encabezado de direcci\u00f3n de correo electr\u00f3nico manipulado que desencadena una recursi\u00f3n infinita en el analizador de direcciones."}], "lastModified": "2026-10-27T05:16:55.207", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nodemailer:nodemailer:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "3ABBB33C-621B-4520-99B8-1C687484F816", "versionEndExcluding": "7.0.11"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4B0E6B4B-BAA6-474E-A18C-72C9719CEC1F"}, {"criteria": "cpe:2.3:a:redhat:ceph_storage:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "52AE9D9D-5D74-4AB8-8FF9-5CEA2A1A97B8"}, {"criteria": "cpe:2.3:a:redhat:developer_hub:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C64C29AF-F32F-4AC1-BC84-276B4024D0C5"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}