CVE-2026-100702CWE-674

CVE-2026-100702

Medium · published September 26, 2026

CVSS v3.1
5.9
EPSS
0%
Percentile
15.4
In the wild
Unconfirmed
What it is

Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, allowing attackers to cause stack exhaustion. Attackers can supply a deeply nested JSON recipient array that triggers recursive Array.toString() conversion, exhausting the call stack and terminating the Node.js process.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
8.2 · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00250 · 15.4th percentile
Weakness
CWE-674 · Uncontrolled Recursion
Published
2026-09-26T18:16Z
References (2)
https://github.com/nodemailer/nodemailer/security/advisories/GHSA-8vvx-rff5-p5rq · [email protected]https://www.vulncheck.com/advisories/nodemailer-before-10.0.2-stack-exhaustion-via-nested-recipient-arrays · [email protected]
EPSS history
Timeline
  • 28 SEP 03:25Z
    EPSS moved — → 0%
    epss
  • 26 SEP 13:23Z
    Nodemailer before 10.0.2 Stack Exhaustion via Nested Recipient Arrays
    cvelistv5