CVE-2025-14874 Nodemailer: nodemailer: denial of service via crafted email address header
Attackers can cause a denial of service in applications using Nodemailer by sending crafted email headers that trigger infinite recursion.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-14874?
CVE-2025-14874 is a high-severity denial of service vulnerability in Red Hat Advanced Cluster Management for Kubernetes 2, published on 18 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the address parser.
Weakness: CWE-703
Which versions are affected by CVE-2025-14874?
4 open source packages ship an affected version, including org.webjars.npm:nodemailer and nodemailer. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
org.webjars.npm:nodemailer Maven | From 3.0.0 to 6.10.1 | None |
org.webjars.npm:nodemailer Maven | From 3.0.0 to 6.10.1 | None |
nodemailer npm | From 3.0.0 | 7.0.11 |
nodemailer npm | From 3.0.0 | 7.0.11 |
Products include Nodemailer Nodemailer, Redhat Advanced Cluster Management for Kubernetes, Redhat Ceph Storage, Redhat Developer Hub.
How do I fix CVE-2025-14874?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-14874 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-14874 exists.
Other vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2
Sources
Also known as CLEANSTART-2026-IS37200, DEBIAN-CVE-2025-14874, ECHO-755a-4a7b-f66f, GHSA-rcmh-qjqh-p98v, MINI-3vgm-4478-cx2f, MINI-5pvq-gmqx-4cp4 and 9 more.