fix(deps): update dependency nodemailer to v6.9.9 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
nodemailer (source)	6.9.6 -> 6.9.9

GitHub Vulnerability Alerts

CVE-2020-7769

This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transport for sending mails.

CVE-2021-23400

The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object.

GHSA-9h6g-pr28-7cqp

Summary

A ReDoS vulnerability occurs when nodemailer tries to parse img files with the parameter attachDataUrls set, causing the stuck of event loop.
Another flaw was found when nodemailer tries to parse an attachments with a embedded file, causing the stuck of event loop.

Details

Regex: /^data:((?:[^;];)(?:[^,])),(.)$/

Path: compile -> getAttachments -> _processDataUrl

Regex: /(<img\b[^>]* src\s*=[\s"']*)(data:([^;]+);[^"'>\s]+)/

Path: _convertDataImages

PoC

https://gist.github.com/francoatmega/890dd5053375333e40c6fdbcc8c58df6
https://gist.github.com/francoatmega/9aab042b0b24968d7b7039818e8b2698

Impact

ReDoS causes the event loop to stuck a specially crafted evil email can cause this problem.

---

Release Notes

nodemailer/nodemailer (nodemailer)

v6.9.9

Compare Source

Bug Fixes

• security: Fix issues described in GHSA-9h6g-pr28-7cqp. Do not use eternal matching pattern if only a few occurences are expected (dd8f5e8)
• tests: Use native node test runner, added code coverage support, removed grunt (#​1604) (be45c1b)

v6.9.8

Compare Source

Bug Fixes

• punycode: do not use native punycode module (b4d0e0c)

v6.9.7

Compare Source

Bug Fixes

• customAuth: Do not require user and pass to be set for custom authentication schemes (fixes #​1584) (41d482c)

---

Configuration

📅 Schedule: Branch creation - "" in timezone Europe/Paris, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues

Measures
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarCloud

[socket-security]

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
npm/cookie@0.4.2	None	0	19.7 kB	dougwilson
npm/csv-parse@5.5.3	None	0	1.4 MB	david
npm/csv-stringify@6.4.5	None	0	921 kB	david
npm/docx@7.8.2	None	+5	6.86 MB	dolanmiu
npm/email-addresses@5.0.0	None	0	130 kB	jackbowman
npm/emailjs@4.0.3	None	+1	64.2 MB	eleith
npm/enquirer@2.4.1	environment	0	189 kB	jonschlinkert
npm/eslint-config-next@14.1.0	unsafe Transitive: environment, eval, filesystem	+22	72.5 MB	vercel-release-bot
npm/eslint-config-prettier@8.6.0	Transitive: environment, eval, filesystem, unsafe	+11	4.48 MB	lydell
npm/eslint-import-resolver-typescript@3.5.5	Transitive: environment, eval, filesystem, unsafe	+12	5.57 MB	jounqin
npm/eslint-plugin-import@2.26.0	filesystem, unsafe Transitive: environment, eval	+11	5.52 MB	ljharb
npm/eslint-plugin-jest@27.2.3	filesystem Transitive: environment, eval, unsafe	+21	72.9 MB	simenb
npm/eslint-plugin-jsx-a11y@6.6.1	Transitive: environment, eval, filesystem, unsafe	+11	5.14 MB	ljharb
npm/eslint-plugin-prettier@4.2.1	Transitive: environment, eval, filesystem, unsafe	+12	15.8 MB	jounqin
npm/eslint-plugin-react-hooks@4.2.0	environment Transitive: eval, filesystem, unsafe	+11	4.58 MB	gaearon
npm/eslint-plugin-react@7.31.11	filesystem Transitive: environment, eval, unsafe	+11	5.24 MB	ljharb
npm/eslint-plugin-simple-import-sort@8.0.0	Transitive: environment, eval, filesystem, unsafe	+11	4.5 MB	lydell
npm/eslint-plugin-sort-keys-fix@1.1.2	None	+1	159 kB	leo-buneev
npm/eslint-scope@5.1.1	None	0	78.4 kB	eslintbot
npm/eslint@7.32.0	filesystem Transitive: environment, eval, unsafe	+10	4.46 MB	eslintbot
npm/espree@7.3.1	None	0	72.9 kB	eslintbot
npm/estree-walker@1.0.1	None	0	15.2 kB	rich_harris
npm/faker@5.5.3	None	0	10.1 MB	marak
npm/file-saver@2.0.5	None	0	36 kB	endless
npm/functional-red-black-tree@1.0.1	None	0	43.5 kB	mikolalysenko
npm/html-react-parser@1.4.14	Transitive: environment	+1	707 kB	remarkablemark
npm/husky@7.0.4	filesystem, shell	0	6.06 kB	typicode
npm/javascript-state-machine@3.1.0	None	0	90.7 kB	jakesgordon
npm/jest@27.5.1	None	0	4.74 kB	simenb
npm/js-base64@3.7.7	None	0	38.6 kB	dankogai
npm/js-yaml@3.14.1	eval	0	291 kB	vitaly
npm/jspdf-autotable@3.8.2	Transitive: filesystem	+1	15 MB	someatoms
npm/jspdf@2.5.1	filesystem	0	14.7 MB	mrjameshall
npm/jszip@3.10.1	None	0	762 kB	stuk
npm/lint-staged@12.5.0	None	0	106 kB	okonet
npm/maildev@1.1.1	filesystem, network	0	4.86 MB	djfarrelly
npm/mini-svg-data-uri@1.4.4	None	0	10.5 kB	tigt
npm/mjml@4.15.3	None	0	8.97 kB	iryusa
npm/multer@1.4.4	filesystem	0	27.9 kB	linusu
npm/next-auth@4.0.2	environment, network	+3	3.59 MB	balazsorban
npm/next@11.1.4	environment, filesystem, network, shell, unsafe	+2	45 MB	vercel-release-bot
npm/prettier@2.8.8	environment, filesystem, unsafe	0	11.2 MB	prettier-bot
npm/react-chartjs-2@4.3.1	Transitive: environment	+1	347 kB	dangreen
npm/react-dom@17.0.2	environment	+1	3.28 MB	gaearon
npm/react@17.0.2	environment	0	291 kB	gaearon
npm/remixicon@2.5.0	None	0	4.36 MB	wendygaoyuan
npm/slugify@1.6.6	None	0	20.9 kB	simov
npm/swr@1.3.0	Transitive: environment	+1	522 kB	quietshu
npm/ts-node@10.9.2	environment, filesystem, unsafe	+3	68.8 MB	blakeembrey
npm/typescript@4.5.2	None	0	64 MB	typescript-bot
npm/undici-types@5.26.5	None	0	73.1 kB	ethan_arrowood
npm/use-debounce@7.0.1	Transitive: environment	+1	347 kB	xnimorz
npm/xml-js@1.6.11	None	0	421 kB	nashwaan
npm/xml@1.0.1	None	0	23.4 kB	dylang

🚮 Removed packages: npm/@babel/plugin-syntax-async-generators@7.8.4, npm/@babel/plugin-syntax-bigint@7.8.3, npm/@babel/plugin-syntax-class-properties@7.12.13, npm/@babel/plugin-syntax-import-meta@7.10.4, npm/@babel/plugin-syntax-json-strings@7.8.3, npm/@babel/plugin-syntax-jsx@7.14.5, npm/@babel/plugin-syntax-logical-assignment-operators@7.10.4, npm/@babel/plugin-syntax-nullish-coalescing-operator@7.8.3, npm/@babel/plugin-syntax-numeric-separator@7.10.4, npm/@babel/plugin-syntax-object-rest-spread@7.8.3, npm/@babel/plugin-syntax-optional-catch-binding@7.8.3, npm/@babel/plugin-syntax-optional-chaining@7.8.3, npm/@babel/plugin-syntax-top-level-await@7.14.5, npm/@babel/plugin-syntax-typescript@7.23.3, npm/@babel/runtime-corejs3@7.23.9, npm/@bcoe/v8-coverage@0.2.3, npm/@cspotcode/source-map-support@0.8.1, npm/@eslint-community/eslint-utils@4.4.0, npm/@hapi/accept@5.0.2, npm/@hapi/boom@9.1.4, npm/@hapi/hoek@9.3.0, npm/@humanwhocodes/object-schema@1.2.1, npm/@istanbuljs/load-nyc-config@1.1.0, npm/@istanbuljs/schema@0.1.3, npm/@jest/console@27.5.1, npm/@jest/core@27.5.1, npm/@jest/environment@27.5.1, npm/@jest/fake-timers@27.5.1, npm/@jest/globals@27.5.1, npm/@jest/reporters@27.5.1, npm/@jest/source-map@27.5.1, npm/@jest/test-result@27.5.1, npm/@jest/test-sequencer@27.5.1, npm/@jest/transform@27.5.1, npm/@jest/types@27.5.1, npm/@napi-rs/triples@1.2.0, npm/@next/env@11.1.4, npm/@next/eslint-plugin-next@14.1.0, npm/@next/polyfill-module@11.1.4, npm/@next/react-dev-overlay@11.1.4, npm/@next/react-refresh-utils@11.1.4, npm/@next/swc-darwin-arm64@11.1.4, npm/@next/swc-darwin-x64@11.1.4, npm/@next/swc-linux-x64-gnu@11.1.4, npm/@next/swc-win32-x64-msvc@11.1.4, npm/@node-rs/helper@1.2.1, npm/@one-ini/wasm@0.1.1, npm/@pkgr/utils@2.4.2, npm/@sinonjs/commons@1.8.6, npm/@sinonjs/fake-timers@8.1.0, npm/@tootallnate/once@1.1.2, npm/@tsconfig/node10@1.0.9, npm/@tsconfig/node12@1.0.11, npm/@tsconfig/node14@1.0.3, npm/@tsconfig/node16@1.0.4, npm/@types/babel__core@7.20.5, npm/@types/babel__generator@7.6.8, npm/@types/babel__template@7.4.4, npm/@types/babel__traverse@7.20.5, npm/@types/graceful-fs@4.1.9, npm/@types/istanbul-lib-coverage@2.0.6, npm/@types/istanbul-lib-report@3.0.3, npm/@types/istanbul-reports@3.0.4, npm/@types/prettier@2.7.3, npm/@types/raf@3.4.3, npm/@types/semver@7.5.7, npm/@types/stack-utils@2.0.3, npm/@types/yargs-parser@21.0.3, npm/@types/yargs@16.0.9, npm/@typescript-eslint/utils@5.62.0, npm/abab@2.0.6, npm/abbrev@2.0.0, npm/accepts@1.3.8, npm/acorn-globals@6.0.0, npm/acorn-walk@7.2.0, npm/acorn@7.4.1, npm/addressparser@1.0.1, npm/after@0.8.2, npm/anser@1.4.9, npm/ansi-colors@4.1.3, npm/ansi-escapes@4.3.2, npm/arg@4.1.3, npm/argparse@1.0.10, npm/array-flatten@1.1.1, npm/arraybuffer.slice@0.0.7, npm/asn1.js@5.4.1, npm/assert@2.0.0, npm/ast-types@0.13.2, npm/astral-regex@2.0.0, npm/async-limiter@1.0.1, npm/async@3.2.5, npm/atob@2.1.2, npm/babel-jest@27.5.1, npm/babel-plugin-istanbul@6.1.1, npm/babel-plugin-jest-hoist@27.5.1, npm/babel-preset-current-node-syntax@1.0.1, npm/babel-preset-jest@27.5.1, npm/backo2@1.0.2, npm/base32.js@0.1.0, npm/base64-arraybuffer@0.1.5, npm/base64-js@1.5.1, npm/base64id@1.0.0, npm/better-assert@1.0.2, npm/big.js@5.2.2, npm/blob@0.0.5, npm/bn.js@5.2.1, npm/body-parser@1.20.1, npm/boolbase@1.0.0, npm/bplist-parser@0.2.0, npm/brorand@1.1.0, npm/browser-process-hrtime@1.0.0, npm/browserify-aes@1.2.0, npm/browserify-cipher@1.0.1, npm/browserify-des@1.0.2, npm/browserify-rsa@4.1.0, npm/browserify-sign@4.2.2, npm/browserify-zlib@0.2.0, npm/bser@2.1.1, npm/btoa@1.2.1, npm/buffer-xor@1.0.3, npm/buffer@5.6.0, npm/builtin-status-codes@3.0.0, npm/bundle-name@3.0.0, npm/busboy@0.2.14, npm/bytes@3.1.2, npm/callsite@1.0.0, npm/camel-case@3.0.0, npm/camelcase@5.3.1, npm/canvg@3.0.10, npm/char-regex@1.0.2, npm/cheerio-select@2.1.0, npm/cheerio@1.0.0-rc.12, npm/ci-info@3.9.0, npm/cipher-base@1.0.4, npm/cjs-module-lexer@1.2.3, npm/clean-css@4.2.4, npm/cli-cursor@3.1.0, npm/cli-truncate@3.1.0, npm/cliui@8.0.1, npm/cssselect@0.4.1, npm/csswhat@0.4.7

View full report↗︎