CVE Vulnerability Catalog

Nodemailer's SMTP client applies four regular expressions to a peer's EHLO response to detect supported SASL mechanisms. Each pattern uses overlapping whitespace-matching sub-patterns, producing quadratic (O(n^2)) backtracking on long mechanism names.

Nodemailer's address parser has three published, patched fixes for RFC 5322 comment handling inside an addr-spec. The description covers earlier issues with glued domain atoms and quoted local parts, plus related ReDoS fixes.

Nodemailer's SMTP client response parser reassembles multiline server replies by appending each continuation line onto a single response-queue entry and re-testing whether it is still a partial reply on every line. The partial-response test performs string operations per line, which can lead to inefficient processing.

net-ssh's transport packet reader trusts the 4-byte wire packet length without capping it against RFC 4253 §6.1 (35000 bytes). Pre-KEX (plaintext), a malicious server can declare an arbitrarily large packet length and stream data, causing unbounded client memory growth before authentication.

Net::SSH::Transport::ServerVersion#read! appends each received byte to @version until a newline, then copies to @header, with no maximum line length or total byte cap enforced. A malicious server sending a long identification line without LF causes unbounded memory growth.

When a crafted ed25519 private key containing an insane number of rounds is loaded, net-ssh enters an infinite CPU-time consuming loop for a very long time trying to load the key. The fact that the key is not a real SSH key does not matter in this regard.

Shell command injection is possible in Net::SSH::Proxy::Command and Net::SSH::Proxy::Jump. When an application configures a proxy and passes attacker-influenced host, port, or remote_user values to Net::SSH.start (or a jump string to Proxy::Jump.new), shell metacharacters in those values may be interpreted.

Decode, DecodeChain, DecodeTrustStore, and ToPEM can incorrectly accept PKCS#12 files which were encoded with the wrong password, due to a failure to reject excessively-short PBMAC1 keys. Users who decode PKCS#12 files from untrusted sources and rely on the password for authentication can be affected.