{"id":"EUVD-2025-204250","enisaUuid":"bb02869a-cdc4-3dc1-b41c-c4bb5f155178","description":"A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the address parser.","datePublished":"Dec 18, 2025, 8:40:31 AM","dateUpdated":"Oct 27, 2026, 4:36:27 AM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://access.redhat.com/security/cve/CVE-2025-14874\nhttps://bugzilla.redhat.com/show_bug.cgi?id\u003d2418133\nhttps://github.com/nodemailer/nodemailer\nhttps://github.com/nodemailer/nodemailer/commit/b61b9c0cfd682b6f647754ca338373b68336a150\nhttps://github.com/nodemailer/nodemailer/security/advisories/GHSA-rcmh-qjqh-p98v\n","aliases":"CVE-2025-14874\nGHSA-46j5-6fg5-4gv3\nGHSA-rcmh-qjqh-p98v\n","assigner":"redhat","epss":0.6,"enisaIdProduct":[{"id":"a1a9bb6a-6c8c-3d5c-837a-1cecd9a82e43","product":{"name":"nodemailer","vendor":{"name":"nodemailer"}},"product_version":"0 \u003c7.0.11"}],"enisaIdVendor":[{"id":"ce41c4e0-a880-3cf3-94a4-b3f88fc2848b","vendor":{"name":"nodemailer"}}],"enisaIdVulnerability":[{"id":"0b93f59c-48d0-3468-8f4f-8626c70b3fce","vulnerability":{"id":"CVE-2025-14874","description":"A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the address parser.","datePublished":"Dec 18, 2025, 8:40:31 AM","dateUpdated":"Oct 27, 2026, 4:36:27 AM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://access.redhat.com/security/cve/CVE-2025-14874\nhttps://bugzilla.redhat.com/show_bug.cgi?id\u003d2418133\nhttps://github.com/nodemailer/nodemailer\nhttps://github.com/nodemailer/nodemailer/commit/b61b9c0cfd682b6f647754ca338373b68336a150\nhttps://github.com/nodemailer/nodemailer/security/advisories/GHSA-rcmh-qjqh-p98v\n","enisa_id":"EUVD-2025-204250\n","assigner":"redhat","epss":0.6,"dataProcessed":"Oct 31, 2026, 7:16:57 AM","vulnerabilityProduct":[{"id":"ebf9a54c-e925-3ba4-8d20-03524d871381","product":{"name":"nodemailer","vendor":{"name":"nodemailer"}},"product_version":"0 \u003c7.0.11"}],"vulnerabilityVendor":[{"id":"a527762e-c9b6-38f7-83e7-0322c32d0229","vendor":{"name":"nodemailer"}}]}},{"id":"4ab88bf0-7508-362e-ad60-c95ddf76b5a2","vulnerability":{"id":"GHSA-rcmh-qjqh-p98v","description":"Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls","datePublished":"Dec 1, 2025, 8:44:25 PM","dateUpdated":"Jul 15, 2026, 9:55:30 PM","baseScore":0.0,"references":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-rcmh-qjqh-p98v\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-14874\nhttps://github.com/nodemailer/nodemailer/commit/6218b8df\nhttps://github.com/nodemailer/nodemailer/commit/b61b9c0cfd682b6f647754ca338373b68336a150\nhttps://access.redhat.com/security/cve/CVE-2025-14874\nhttps://bugzilla.redhat.com/show_bug.cgi?id\u003d2418133\nhttps://github.com/nodemailer/nodemailer\n","enisa_id":"EUVD-2025-204250\n","aliases":"GHSA-rcmh-qjqh-p98v\nCVE-2025-14874\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:51:54 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"eb4c5c93-3a00-35e0-ba87-6bb980f12d48","vulnerability":{"id":"GHSA-46j5-6fg5-4gv3","description":"Duplicate Advisory: Nodemailer is vulnerable to DoS through Uncontrolled Recursion","datePublished":"Dec 18, 2025, 9:30:30 AM","dateUpdated":"Feb 3, 2026, 5:37:53 PM","baseScore":0.0,"references":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-rcmh-qjqh-p98v\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-14874\nhttps://github.com/nodemailer/nodemailer/commit/b61b9c0cfd682b6f647754ca338373b68336a150\nhttps://access.redhat.com/security/cve/CVE-2025-14874\nhttps://bugzilla.redhat.com/show_bug.cgi?id\u003d2418133\nhttps://github.com/nodemailer/nodemailer\n","enisa_id":"EUVD-2025-204250\n","aliases":"GHSA-46j5-6fg5-4gv3\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:52:34 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}