CVE-2025-14874highCWE-703

CVE-2025-14874: falha de alta gravidade em nodemailer

Nodemailer: nodemailer: denial of service via crafted email address header

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Red Hat Advanced Cluster Management for Kubernetes+ Monitorar Red Hat Ceph Storage

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.6%
A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the address parser.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
nodemailer · nodemailerRed Hat · Red Hat Advanced Cluster Management for Kubernetes 2Red Hat · Red Hat Ceph Storage 8Red Hat · Red Hat Developer Hub 1
CVEs relacionadas — nodemailer

No mesmo produto, das mais perigosas para as menos.

CVE-2026-82854CRITICALNodemailer before 8.0.4 SMTP Command Injection via envelope.sizeEPSS 2.0%CVE-2026-66786CRITICALSubmariner: submariner: ipsec.conf stanza injection via remote-supplied cablename and subnetsEPSS 1.4%CVE-2024-3727HIGHContainers/image: digest type does not guarantee valid typeEPSS 1.3%CVE-2025-4598MEDIUMSystemd-coredump: race condition that allows a local attacker to crash a suid program and gain read access to the resulting core dumpEPSS 1.3%CVE-2024-11831MEDIUMNpm-serialize-javascript: cross-site scripting (xss) in serialize-javascriptEPSS 1.1%CVE-2026-82853MEDIUMNodemailer before 8.0.5 SMTP Command Injection via CRLFEPSS 1.0%