CVE-2026-100702: Nodemailer Stack Exhaustion DOS Vulnerability

CVE-2026-100702 Overview

CVE-2026-100702 is a denial-of-service vulnerability in Nodemailer versions prior to 10.0.2. The library fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc. An attacker who can influence recipient input can submit a deeply nested JSON array that triggers recursive Array.toString() conversion. The recursion exhausts the Node.js call stack and terminates the process. The weakness is classified as uncontrolled recursion [CWE-674].

Critical Impact
Remote attackers can crash Node.js services that pass untrusted recipient data to Nodemailer, producing a reliable denial of service against mail-sending applications.

Affected Products

Nodemailer versions before 10.0.2
Node.js applications using Nodemailer for outbound email
Services that accept user-supplied recipient fields and forward them to Nodemailer

Discovery Timeline

2026-09-26 - CVE-2026-100702 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-100702

Vulnerability Analysis

Nodemailer accepts recipient addresses as strings or arrays in the to, cc, and bcc fields of a message object. When processing these fields, the library converts arrays into comma-separated address lists. The conversion relies on JavaScript's default Array.prototype.toString() behavior, which recursively invokes toString() on nested array elements. Nodemailer does not flatten or depth-limit the input before this conversion.

Submitting a recipient value that nests arrays many levels deep forces the JavaScript engine to recurse once per nesting level. Each recursive call consumes a stack frame. Once the engine exhausts its fixed-size call stack, V8 throws a RangeError: Maximum call stack size exceeded that propagates out of the mail-sending path and terminates the Node.js worker.

Root Cause

The root cause is unbounded recursion during recipient normalization. Nodemailer trusts the shape of recipient input and delegates string conversion to the runtime without validating nesting depth or applying iterative flattening. Any code path that reaches the recipient serialization routine with a nested array of sufficient depth will trigger the crash.

Attack Vector

Exploitation requires network-adjacent input that reaches a Nodemailer sendMail call. Typical attack surfaces include contact forms, password-reset endpoints, notification APIs, and webhook handlers that accept JSON recipient lists. An attacker submits a request containing a nested array such as [[[[...["attacker@example.com"]...]]]] as the to value. The depth required to exhaust the stack is well within standard JSON payload size limits. No authentication is required when the vulnerable endpoint is publicly reachable.

Successful exploitation does not disclose data or allow code execution. The impact is confined to availability: the Node.js process crashes, interrupting in-flight requests and any other work handled by that worker.

Detection Methods for CVE-2026-100702

Indicators of Compromise

Node.js process crashes accompanied by RangeError: Maximum call stack size exceeded in stack traces originating from Nodemailer modules.
Repeated worker restarts under process managers such as pm2, systemd, or Kubernetes shortly after inbound requests to mail-triggering endpoints.
HTTP request bodies containing deeply nested JSON arrays in recipient fields.

Detection Strategies

Inventory installed Nodemailer versions across Node.js services using npm ls nodemailer or software composition analysis, and flag versions below 10.0.2.
Inspect application and reverse-proxy logs for recipient fields with abnormal JSON nesting depth or oversized array structures.
Correlate unexpected Node.js process exits with preceding requests to endpoints that invoke transporter.sendMail.

Monitoring Recommendations

Alert on RangeError exceptions in centralized application logs for services that import nodemailer.
Track process restart counts for mail-handling workers and generate alerts on anomalous spikes.
Monitor WAF or API gateway telemetry for request payloads whose JSON parse depth exceeds application norms.

How to Mitigate CVE-2026-100702

Immediate Actions Required

Upgrade Nodemailer to version 10.0.2 or later in all affected services and redeploy.
Audit every call site that passes externally sourced data into Nodemailer recipient fields.
Enforce schema validation on inbound mail requests so recipient fields accept only strings or flat arrays of strings.

Patch Information

The maintainers resolved the issue in Nodemailer 10.0.2 by properly flattening nested arrays before converting recipient values to strings. Refer to the GitHub Security Advisory GHSA-8vvx-rff5-p5rq and the VulnCheck Advisory for Nodemailer for release details.

Workarounds

Validate recipient inputs with a schema library such as zod, joi, or ajv and reject non-string array elements before invoking Nodemailer.
Normalize recipient arrays with Array.prototype.flat(Infinity) and enforce a maximum element count prior to calling sendMail.
Limit JSON parsing depth at the HTTP layer using middleware or reverse-proxy rules to block deeply nested payloads.

bash

# Configuration example
npm install nodemailer@^10.0.2
npm ls nodemailer