CVE-2026-100702
Received Received - Intake

Nodemailer Stack Exhaustion via Deeply Nested Recipient Arrays

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, allowing attackers to cause stack exhaustion. Attackers can supply a deeply nested JSON recipient array that triggers recursive Array.toString() conversion, exhausting the call stack and terminating the Node.js process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100702
EUVD
EUVD-2026-87675

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nodemailer nodemailer to 10.0.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Nodemailer before version 10.0.2 has a flaw where deeply nested arrays in recipient fields like to, cc, and bcc are not properly flattened. This causes recursive Array.toString() conversion when processing the arrays, leading to stack exhaustion and crashing the Node.js process.

Detection Guidance

To detect this vulnerability, monitor for crashes in Node.js processes using Nodemailer. Check logs for RangeError stack overflow errors during email processing. Use commands like 'ps aux | grep node' to identify running Node.js processes and 'netstat -tulnp' to check for unusual network activity from email services.

Impact Analysis

An attacker can send a maliciously crafted JSON with excessive nested arrays to crash your Node.js application using Nodemailer. This causes denial of service by terminating the process, affecting HTTP APIs, queue workers, and multi-tenant applications.

Mitigation Strategies

Immediately upgrade Nodemailer to version 10.0.2 or later. If upgrading is not possible, validate recipient inputs to ensure they are flat strings or arrays before passing them to Nodemailer. Implement input sanitization to reject excessively nested structures.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100702. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart