VulnSocial

CVE-2025-14874Disclosure(nodemailer / advanced_cluster_management_for_kubernetes)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch nodemailer advanced_cluster_management_for_kubernetes systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the address parser.

nodemailer CVEsBack to dashboard
1.5/ 10 priority

Sources & remediation

Patch / fix
Exploit / PoC references
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-703

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • advanced_cluster_management_for_kubernetes
  • ceph_storage
  • developer_hub
  • nodemailer

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-09-09); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
nodemailerredhat
Products
advanced_cluster_management_for_kubernetesceph_storagedeveloper_hubnodemailer

3 versions affected across 4 products

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-09: 1Mentions · 2026-10-08: 1Patch / Workaround · 2026-10-08: 1Technical Details · 2026-09-09: 1Technical Details · 2026-10-08: 109-0910-08
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Referenced assets1 URL
Classification over time
DateTotalLabels
2026-09-091
Disclosure1
2026-10-081
Patch1
Full discourse2 posts
  • DFIR Lab@DFIR_Lab
    Patch

    🚨 HIGH severity CVE-2025-14874 (CVSS 7.5) affects Nodemailer. DoS vulnerability via crafted email address header triggers infinite recursion in address parser. Network exploitable, no auth required. Patch immediately. #CVE #Vulnerability #PatchNow https://t.co/EIFJlltR04

    Post summary

    The tweet discloses a high-severity DoS vulnerability in Nodemailer (CVE-2025-14874) with specific technical details and explicitly urges users to patch immediately.

    0000035
    147 followersView on X
  • DailyCVE@dailycve
    Disclosure

    🔴 Nodemailer, Address Parser Quadratic DoS, #CVE-2025-14874 (Critical) -DC-Sep2026-2280 https://dailycve.com/nodemailer-address-parser-quadratic-dos-cve-2025-14874-critical-dc-sep2026-2280/

    Post summary

    The post announces a critical Quadratic DoS vulnerability (CVE‑2025‑14874) in Nodemailer’s address parser, with no PoC, exploit tool, or active exploitation mentioned.

    0000035
    237 followersView on X
CPE platform detail4 entries

4 of 4 entries

PartVendorProductVersionTarget SWTarget HW
Appnodemailernodemailer-node.js-
Appredhatadvanced_cluster_management_for_kubernetes2.0--
Appredhatceph_storage8.0--
Appredhatdeveloper_hub---

Explore more

Back to dashboardnodemailer CVEsredhat CVEsadvanced_cluster_management_for_kubernetes vulnerabilities