Name of the Vulnerable Software and Affected Versions Nodemailer (affected versions not specified)

Description A Denial of Service (DoS) can occur due to the use of an unsafe function in the email address parser located in lib/addressparser/index.js. The parser attempts to flatten nested group structures, which are prohibited by RFC 5322. When processing a malicious address header containing numerous colons (:) used to define groups, the parser enters an infinite recursion loop through the pattern addressparser → handleAddress → addressparser. This occurs because no recursion depth limit is enforced, eventually leading to a Maximum call stack size exceeded error that terminates the Node.js process immediately. This issue requires no authentication and can be triggered with a single request, potentially causing a continuous restart loop in environments using process managers like PM2 or Forever.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.