{"id":"EUVD-2026-87675","enisaUuid":"c8080c9e-9dbc-36dd-89e1-902f7b519e40","description":"Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, allowing attackers to cause stack exhaustion. Attackers can supply a deeply nested JSON recipient array that triggers recursive Array.toString() conversion, exhausting the call stack and terminating the Node.js process.","datePublished":"Sep 26, 2026, 1:23:57 PM","dateUpdated":"Sep 26, 2026, 11:11:16 PM","baseScore":8.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-8vvx-rff5-p5rq\nhttps://www.vulncheck.com/advisories/nodemailer-before-10.0.2-stack-exhaustion-via-nested-recipient-arrays\n","aliases":"CVE-2026-100702\nGHSA-5hcf-56h7-4fvx\n","assigner":"VulnCheck","epss":0.25,"enisaIdProduct":[{"id":"20e9e02f-33ff-3cff-b6f1-2b4d6eff39b8","product":{"name":"nodemailer","vendor":{"name":"nodemailer"}},"product_version":"0 \u003c10.0.2"}],"enisaIdVendor":[{"id":"4e7eea5d-2819-33ba-afe8-4fabfa791838","vendor":{"name":"nodemailer"}}],"enisaIdVulnerability":[{"id":"7e0fdacb-e123-31b5-af5c-46dd130424c8","vulnerability":{"id":"GHSA-5hcf-56h7-4fvx","description":"Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, allowing attackers to cause stack exhaustion. Attackers can supply a deeply nested JSON recipient array that triggers recursive Array.toString() conversion, exhausting the call stack and terminating the Node.js process.","datePublished":"Sep 26, 2026, 3:31:22 PM","dateUpdated":"Sep 26, 2026, 3:31:22 PM","baseScore":0.0,"references":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-8vvx-rff5-p5rq\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-100702\nhttps://www.vulncheck.com/advisories/nodemailer-before-10.0.2-stack-exhaustion-via-nested-recipient-arrays\n","enisa_id":"EUVD-2026-87675\n","aliases":"CVE-2026-100702\nGHSA-5hcf-56h7-4fvx\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"a15adfbc-5d14-3ed9-a249-57de6ee7a379","vulnerability":{"id":"CVE-2026-100702","description":"Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, allowing attackers to cause stack exhaustion. Attackers can supply a deeply nested JSON recipient array that triggers recursive Array.toString() conversion, exhausting the call stack and terminating the Node.js process.","datePublished":"Sep 26, 2026, 1:23:57 PM","dateUpdated":"Sep 26, 2026, 11:11:16 PM","status":"PUBLISHED","baseScore":8.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-8vvx-rff5-p5rq\nhttps://www.vulncheck.com/advisories/nodemailer-before-10.0.2-stack-exhaustion-via-nested-recipient-arrays\n","enisa_id":"EUVD-2026-87675\n","assigner":"VulnCheck","epss":0.25,"dataProcessed":"Oct 27, 2026, 7:15:40 AM","vulnerabilityProduct":[{"id":"8b10b145-2a8c-33a5-8bc3-8b42390b2a42","product":{"name":"nodemailer","vendor":{"name":"nodemailer"}},"product_version":"0 \u003c10.0.2"}],"vulnerabilityVendor":[{"id":"6961b980-26c9-32fc-bf76-6356707d57c3","vendor":{"name":"nodemailer"}}]}}],"enisaIdAdvisory":[]}