https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 20 Oct 2026 19:17:13 +0000 https://db.gcve.eu/vuln/ghsa-v53p-9fqp-m79j <p><strong>Affected:</strong> npm: nodemailer</p> <p>### Summary</p> <p>When `addressparser` finds no address by its strict reading, it falls back to pulling one out of the free text with `/\s*\b[^@\s]+@[^\s]+\b\s*/`. That pattern backtracks quadratically: `[^@\s]+` is retried from every offset and rescans the run to the next `@` each time. A single header value holding a long whitespace-free run with no usable `@` blocks the Node.js event loop for tens of seconds.</p> <p>It is cheaper to exploit than GHSA-prgh-xp8r-p3m5: 273KB is enough for ~43s, where the comment-joined shape needed ~1.5MB for ~10s.</p> <p>### Details</p> <p>The fallback in `src/addressparser/index.ts` ran the pattern as a search. `[^@\s]+` crosses neither whitespace nor `@`, so from each start offset it scans forward to the next `@` or to the end of the run and then fails, and the engine simply advances one character and repeats. Three shapes make every offset fail:</p> <p>- the run holds no `@` at all - the only `@` has nothing after it - the only `@` has nothing before it</p> <p>A fourth reaches it with a valid address present but placed past a long run, so the long run is walked before the match is found.</p> <p>### PoC</p> <p>```js const addressparser = require(&#39;nodemailer/lib/addressparser&#39;); const s = Date.now(); addressparser(&#39; &gt;&#39; + &#39;&gt;[x][x]&#39;.repeat(40000)); // 273KB console.log(Date.now() - s, &#39;ms&#39;); // ~43000 ms, blocking ```</p> <p>Measured on 10.0.5:</p> <p>| Value | Parse time | | --- | --- | | `&#39;[x]&#39;.repeat(40000)` (117KB) | 9.0 s | | `&#39;[x]&#39;.repeat(40000) + &#39;@&#39;` (117KB) | 8.9 s | | `&#39;@&#39; + &#39;[x]&#39;.repeat(4…</p> <p><strong>Affected:</strong> npm: nodemailer</p> <p>### Summary</p> <p>When `addressparser` finds no address by its strict reading, it falls back to pulling one out of the free text with `/\s*\b[^@\s]+@[^\s]+\b\s*/`. That pattern backtracks quadratically: `[^@\s]+` is retried from every offset and rescans the run to the next `@` each time. A single header value holding a long whitespace-free run with no usable `@` blocks the Node.js event loop for tens of seconds.</p> <p>It is cheaper to exploit than GHSA-prgh-xp8r-p3m5: 273KB is enough for ~43s, where the comment-joined shape needed ~1.5MB for ~10s.</p> <p>### Details</p> <p>The fallback in `src/addressparser/index.ts` ran the pattern as a search. `[^@\s]+` crosses neither whitespace nor `@`, so from each start offset it scans forward to the next `@` or to the end of the run and then fails, and the engine simply advances one character and repeats. Three shapes make every offset fail:</p> <p>- the run holds no `@` at all - the only `@` has nothing after it - the only `@` has nothing before it</p> <p>A fourth reaches it with a valid address present but placed past a long run, so the long run is walked before the match is found.</p> <p>### PoC</p> <p>```js const addressparser = require(&#39;nodemailer/lib/addressparser&#39;); const s = Date.now(); addressparser(&#39; &gt;&#39; + &#39;&gt;[x][x]&#39;.repeat(40000)); // 273KB console.log(Date.now() - s, &#39;ms&#39;); // ~43000 ms, blocking ```</p> <p>Measured on 10.0.5:</p> <p>| Value | Parse time | | --- | --- | | `&#39;[x]&#39;.repeat(40000)` (117KB) | 9.0 s | | `&#39;[x]&#39;.repeat(40000) + &#39;@&#39;` (117KB) | 8.9 s | | `&#39;@&#39; + &#39;[x]&#39;.repeat(4…</p> https://db.gcve.eu/vuln/ghsa-v53p-9fqp-m79j