nodemailer before 6.9.9 ReDoS via attachDataUrls parameter

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2024-58379 · Microsoft / collected KEV context

EUVD-2024-55736

GHSA-7mr3-4pph-3qpg

GHSA-9h6g-pr28-7cqp

cve-program · CVE-2024-58379

• https://github.com/nodemailer/nodemailer/security/advisories/GHSA-9h6g-pr28-7cqp
• https://www.vulncheck.com/advisories/nodemailer-before-6.9.9-redos-via-attachdataurls-parameter

euvd · EUVD-2024-55736

• https://github.com/nodemailer/nodemailer/security/advisories/GHSA-9h6g-pr28-7cqp
• https://www.vulncheck.com/advisories/nodemailer-before-6.9.9-redos-via-attachdataurls-parameter

nvd · CVE-2024-58379

• https://github.com/nodemailer/nodemailer/security/advisories/GHSA-9h6g-pr28-7cqp
• https://www.vulncheck.com/advisories/nodemailer-before-6.9.9-redos-via-attachdataurls-parameter

osv · GHSA-9h6g-pr28-7cqp

• https://github.com/nodemailer/nodemailer/security/advisories/GHSA-9h6g-pr28-7cqp
• https://github.com/nodemailer/nodemailer/commit/dd8f5e8a4ddc99992e31df76bcff9c590035cd4a
• https://gist.github.com/francoatmega/890dd5053375333e40c6fdbcc8c58df6
• https://gist.github.com/francoatmega/9aab042b0b24968d7b7039818e8b2698
• https://github.com/nodemailer/nodemailer

No related operational record is retained in the current change model.