CVE-2024-58379mediumCWE-1333

CVE-2024-58379: fallo de gravedad media en nodemailer

nodemailer before 6.9.9 ReDoS via attachDataUrls parameter

Publicada el

Seguir esta CVE+ Monitorear nodemailer+ Monitorear node-nodemailer

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.9epss 0.4%
nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUrls parameter is set or processing embedded file attachments. Attackers can send specially crafted emails with malicious data URLs or embedded attachments to cause the event loop to hang and deny service.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Productos afectados
nodemailer · nodemailer
CVEs relacionadas — nodemailer

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-82854CRITICALNodemailer before 8.0.4 SMTP Command Injection via envelope.sizeEPSS 2.0%CVE-2026-82853MEDIUMNodemailer before 8.0.5 SMTP Command Injection via CRLFEPSS 1.0%CVE-2026-92596HIGHNodemailer before 9.1.0 Denial of Service via addressparserEPSS 0.8%CVE-2026-90776HIGHNodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address ParsingEPSS 0.7%CVE-2025-14874HIGHNodemailer: nodemailer: denial of service via crafted email address headerEPSS 0.6%CVE-2025-13033HIGHNodemailer: nodemailer: email to an unintended domain can occur due to interpretation conflictEPSS 0.6%