CVE-2025-14874

HighCVSS 7.5/10Last modified Oct 27, 2026

Description

A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the address parser.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-703

Affected software

Vendor	Product	Versions
nodemailer	nodemailer	< 7.0.11
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2	—
Red Hat	Red Hat Ceph Storage 8	—
Red Hat	Red Hat Developer Hub 1	—

References

https://access.redhat.com/security/cve/CVE-2025-14874Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2418133Exploit, Issue Tracking, Third Party Advisory
https://github.com/nodemailer/nodemailerProduct
https://github.com/nodemailer/nodemailer/commit/b61b9c0cfd682b6f647754ca338373b68336a150Patch
https://github.com/nodemailer/nodemailer/security/advisories/GHSA-rcmh-qjqh-p98vExploit, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2418133Exploit, Issue Tracking, Third Party Advisory
https://github.com/nodemailer/nodemailer/security/advisories/GHSA-rcmh-qjqh-p98vExploit, Vendor Advisory

Timeline

Published: Dec 18, 2025
Last modified: Oct 27, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-148756.1The HBLPAY Payment Gateway for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘cusdata’ parameter CVE-2025-148765.5A flaw was found in the virtio-crypto device of QEMU. A malicious guest operating system can exploit a missing length limit in the AKCIPHER CVE-2025-148779.8A vulnerability was identified in Campcodes Supplier Management System 1.0. This affects an unknown function of the file /admin/add_retailer CVE-2025-148789.8A security flaw has been discovered in Tenda WH450 1.0.0.18. This impacts an unknown function of the file /goform/wirelessRestart of the com CVE-2025-148799.8A weakness has been identified in Tenda WH450 1.0.0.18. Affected is an unknown function of the file /goform/onSSIDChange of the component HT CVE-2025-14886.1The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 3.2. This CVE-2025-148805.3The Netcash WooCommerce Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability CVE-2025-148813.8Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be acces CVE-2025-148823.8An API endpoint allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible b CVE-2025-148847.2A vulnerability was detected in D-Link DIR-605 202WWB03. Affected by this issue is some unknown functionality of the component Firmware Upda CVE-2025-148858.8A flaw has been found in SourceCodester Client Database Management System 1.0. This affects an unknown part of the file /user_leads.php of t CVE-2025-148865.3The Japanized for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t