CVE-2025-14874

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-14874
A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the address parser.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://access.redhat.com/security/cve/CVE-2025-14874 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2418133 Exploit Issue Tracking Third Party Advisory
https://github.com/nodemailer/nodemailer Product
https://github.com/nodemailer/nodemailer/commit/b61b9c0cfd682b6f647754ca338373b68336a150 Patch
https://github.com/nodemailer/nodemailer/security/advisories/GHSA-rcmh-qjqh-p98v Exploit Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2418133 Exploit Issue Tracking Third Party Advisory
https://github.com/nodemailer/nodemailer/security/advisories/GHSA-rcmh-qjqh-p98v Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:nodemailer:nodemailer:*:*:*:*:*:node.js:*:*

Configuration 2 (hide)

OR cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:2.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:ceph_storage:8.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:developer_hub:-:*:*:*:*:*:*:*
History

08 Jan 2026, 03:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 5.3 		v2 : unknown
v3 : 7.5

06 Jan 2026, 20:14

Type Values Removed Values Added
References () https://access.redhat.com/security/cve/CVE-2025-14874 - () https://access.redhat.com/security/cve/CVE-2025-14874 - Third Party Advisory
References () https://bugzilla.redhat.com/show_bug.cgi?id=2418133 - () https://bugzilla.redhat.com/show_bug.cgi?id=2418133 - Exploit, Issue Tracking, Third Party Advisory
References () https://github.com/nodemailer/nodemailer - () https://github.com/nodemailer/nodemailer - Product
References () https://github.com/nodemailer/nodemailer/commit/b61b9c0cfd682b6f647754ca338373b68336a150 - () https://github.com/nodemailer/nodemailer/commit/b61b9c0cfd682b6f647754ca338373b68336a150 - Patch
References () https://github.com/nodemailer/nodemailer/security/advisories/GHSA-rcmh-qjqh-p98v - () https://github.com/nodemailer/nodemailer/security/advisories/GHSA-rcmh-qjqh-p98v - Exploit, Vendor Advisory
CPE cpe:2.3:a:nodemailer:nodemailer:*:*:*:*:*:node.js:*:*
cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:2.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:ceph_storage:8.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:developer_hub:-:*:*:*:*:*:*:*
First Time Redhat ceph Storage
Redhat
Redhat advanced Cluster Management For Kubernetes
Nodemailer
Redhat developer Hub
Nodemailer nodemailer

18 Dec 2025, 15:15

Type Values Removed Values Added
References () https://bugzilla.redhat.com/show_bug.cgi?id=2418133 - () https://bugzilla.redhat.com/show_bug.cgi?id=2418133 -
References () https://github.com/nodemailer/nodemailer/security/advisories/GHSA-rcmh-qjqh-p98v - () https://github.com/nodemailer/nodemailer/security/advisories/GHSA-rcmh-qjqh-p98v -

18 Dec 2025, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-12-18 09:15

Updated : 2026-01-08 03:15

NVD link : CVE-2025-14874

Mitre link : CVE-2025-14874

CVE.ORG link : CVE-2025-14874

JSON object : View

Products Affected

redhat

  • ceph_storage
  • developer_hub
  • advanced_cluster_management_for_kubernetes

nodemailer

  • nodemailer
CWE
CWE-703

Improper Check or Handling of Exceptional Conditions