@bitblit/ratchet-aws-node-only (>=6.1.226-alpha, <=6.1.231-alpha), @bitblit/ratchet-epsilon-common (>=6.1.226-alpha, <=6.1.231-alpha) +18 more potentially affected by CVE-2025-14874 +1 more via nodemailer (>=10.0.0, <=10.0.1)

nodemailer NPM version =10.0.0, =6.1.226-alpha, =6.1.226-alpha, =6.1.226-alpha, =1.3.1, =12.4.0-depup.0, =39.2.0, =1.14.1, =12.4.0, =2.79.9, =2.80.0 - hyphos 0.5.0 and more Source cves: CVE-2025-14874, CVE-2026-100702 Source advisory: OSV:GHSA-8VVX-RFF5-P5RQ...

CVE-2025-14874 vulnerabilities

Vulnerabilities for packages: langfuse, jitsucom-jitsu...

CVE-2025-14874

Nodemailer CVE-2025-14874 is a DoS vulnerability in the Nodemailer library where a crafted email address header triggers infinite recursion in the address parser. Affected product: Nodemailer (Node.js). Root cause: address parser recursion leading to denial of service. Impact: high availability l...

0.extends.fc (1.0.65), 0.extends.react (1.0.51) +9500 more potentially affected by CVE-2025-14874 via nodemailer (>=3.0.2, <=7.0.10)

nodemailer NPM version =3.0.2, =1.0.49, =1.0.1, =1.0.0, =1.0.0, =0.2.9, =0.2.19 - 123ac 1.0.8 - 123acyashu 1.0.8 and more Source cves: CVE-2025-14874 Source advisory: OSV:GHSA-RCMH-QJQH-P98V...

@activepieces/piece-gmail (>=0.9.6, <=0.10.0), @activepieces/piece-imap (>=0.2.17, <=0.4.5) +114 more potentially affected by CVE-2025-14874 via nodemailer (>=7.0.2, <=7.0.10)

nodemailer NPM version =7.0.2, =0.9.6, =0.2.17, =0.0.11, =0.0.1, =1.0.0, =3.3.1, =0.0.1, =0.6.0, =5.1.121, =3.20.14, =1.2.4, =29.1.0, =32.2.0 - @dont-be-evil-company/libas2 0.4.0 and more Source cves: CVE-2025-14874 Source advisory: SNYK:JS-NODEMAILER-14157156...