Stack Exhaustion Vulnerability in Nodemailer by Nodemailer

CVE-2026-100702

What is CVE-2026-100702?

Nodemailer versions prior to 10.0.2 are susceptible to a stack exhaustion vulnerability caused by improper handling of deeply nested arrays within recipient fields, such as 'to', 'cc', and 'bcc'. Attackers can exploit this weakness by supplying a deeply nested JSON recipient array, which leads to excessive recursive calls during Array.toString() conversions. This ultimately exhausts the call stack, resulting in the termination of the Node.js process, compromising the application’s availability.

References