Nodemailer before 10.0.2 Stack Exhaustion via Nested Recipient Arrays

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-100702 · Microsoft / collected KEV context

EUVD-2026-87675

GHSA-5hcf-56h7-4fvx

GHSA-8vvx-rff5-p5rq

cve-program · CVE-2026-100702

• https://github.com/nodemailer/nodemailer/security/advisories/GHSA-8vvx-rff5-p5rq
• https://www.vulncheck.com/advisories/nodemailer-before-10.0.2-stack-exhaustion-via-nested-recipient-arrays

euvd · EUVD-2026-87675

• https://github.com/nodemailer/nodemailer/security/advisories/GHSA-8vvx-rff5-p5rq
• https://www.vulncheck.com/advisories/nodemailer-before-10.0.2-stack-exhaustion-via-nested-recipient-arrays

nvd · CVE-2026-100702

• https://github.com/nodemailer/nodemailer/security/advisories/GHSA-8vvx-rff5-p5rq
• https://www.vulncheck.com/advisories/nodemailer-before-10.0.2-stack-exhaustion-via-nested-recipient-arrays

osv · GHSA-8vvx-rff5-p5rq

• https://github.com/nodemailer/nodemailer/security/advisories/GHSA-8vvx-rff5-p5rq
• https://github.com/nodemailer/nodemailer/commit/ebe084940aef88278afc6016b78c6d1c3821bb66
• https://github.com/nodemailer/nodemailer
• https://github.com/nodemailer/nodemailer/releases/tag/v10.0.2

• Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, allowing attackers to cause stack exhaustion. Attackers can supply a deeply nested JSON recipient array that triggers recur… · Advisory content revised · 11 Nov 2026