Vulnerability · Published Sep 26, 2026 · Assigned by VulnCheck

CVE-2026-100702Nodemailer before 10.0.2 Stack Exhaustion via Nested Recipient Arrays

Medium 5.9

In plain English

A medium-severity security flaw in nodemailer from nodemailer. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.2%top 83.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, allowing attackers to cause stack exhaustion. Attackers can supply a deeply nested JSON recipient array that triggers recursive Array.toString() conversion, exhausting the call stack and terminating the Node.js process.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	node-nodemailer	no fix listed	DEBIAN-CVE-2026-100702
Debian:13	node-nodemailer	no fix listed	DEBIAN-CVE-2026-100702
Debian:14	node-nodemailer	10.0.10+~8.0.1-1	DEBIAN-CVE-2026-100702
Ubuntu:22.04:LTS	node-nodemailer	no fix listed	UBUNTU-CVE-2026-100702
Ubuntu:24.04:LTS	node-nodemailer	no fix listed	UBUNTU-CVE-2026-100702
Ubuntu:26.04:LTS	node-nodemailer	no fix listed	UBUNTU-CVE-2026-100702
Ubuntu:26.10	node-nodemailer	no fix listed	UBUNTU-CVE-2026-100702
npm	nodemailer	10.0.2	GHSA-8vvx-rff5-p5rq

Affected products (as reported)

Vendor	Product	Versions
nodemailer	nodemailer	0 – before 10.0.2

Weakness: CWE-674 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References

GitHub Security Advisory (GHSA-8vvx-rff5-p5rq) vendor-advisory
VulnCheck Advisory: Nodemailer before 10.0.2 Stack Exhaustion via Nested Recipient Arrays third-party-advisory