CVE-2026-100702: Nodemailer before 10.0.2 Stack Exhaustion via Nested Recipient Arrays
Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, allowing attackers to cause stack exhaustion. Attackers can supply a deeply nested JSON recipient array that triggers recursive Array.toString() conversion, exhausting the call stack and terminating the Node.js process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nodemailerto a version that resolves this vulnerability.Fixed in 10.0.2
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using Nodemailer versions before 10.0.2 are affected if recipient fields can receive deeply nested arrays.
What must an attacker be able to provide?
An attacker must be able to supply a deeply nested JSON array in a recipient field, including to, cc, or bcc. No privileges or user interaction are required according to the provided severity vector.
How can I determine whether an instance is vulnerable?
Check the installed Nodemailer version and review whether untrusted input can populate the to, cc, or bcc fields as nested arrays. Versions before 10.0.2 meet the affected version condition.