Executive brief
Nodemailer, a Node.js email library, fails to properly flatten deeply nested arrays in recipient fields (to, cc, bcc), allowing attackers to crash the email service. An attacker can send a specially crafted JSON with nested arrays that triggers excessive recursion, exhausting the server's call stack and terminating the Node.js process, causing a denial of service that may affect email delivery or related services.
Technical details
The vulnerability stems from improper array flattening in the _parseAddresses() method, which only removes the outermost array layer via concat(), leaving nested arrays intact. When addressparser() processes remaining nested arrays, it calls Array.toString() which recursively descends through all nested levels until the V8 call stack is exhausted. The attack requires network access and no authentication; a ~10 KB payload with 5,000-deep nesting triggers RangeError: Maximum call stack size exceeded during synchronous sendMail() invocation before SMTP transport is reached.
Affected products
- Nodemailer Nodemailer before 10.0.2
Timeline
- 2026-09-26: disclosed: CVE-2026-100702 and GHSA-8vvx-rff5-p5rq published
- 2026-09-26: patched: Patched in version 10.0.2