Nodemailer CVE-2026-100702

Requires an application built on Nodemailer that accepts externally-controlled recipient input (to, cc, or bcc) and passes it into message options without validating or bounding array nesting depth. The malicious input must be a deeply nested JSON recipient array to force recursive Array.toString() flattening into stack exhaustion. Limiting factors: the vulnerability is not exploitable against Nodemailer in isolation - it depends on the host application exposing recipient fields to untrusted input; the CVSS AC:H/AT:P reflects that a sufficiently deep nested structure and a receptive code path are both required. Impact is limited to crashing the Node.js process (recoverable DoS) with no data exposure or code execution.

This is a genuine but bounded denial-of-service issue, not a high-impact compromise. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H) correctly scopes impact to availability only - no confidentiality or integrity loss - so the vendor's 8.2 score is inflated by the network-reachable/unauthenticated framing while the true effect is a single Node.js process crash. AC:H and AT:P are notable: exploitation is not trivial, requiring a specifically deep-nested recipient structure and an application that actually forwards attacker-controlled input into recipient fields. There is NO CISA KEV listing, NO EPSS score provided, and NO public exploit code identified, so exploitation is theoretical at time of analysis. Note the input Tags label this 'Information Disclosure,' which conflicts with both the CWE-674 (uncontrolled recursion) classification and the CVSS impact metrics (VC:N/VI:N/VA:H) - this is an availability/DoS flaw, not information disclosure. Real-world priority is moderate-to-low: the affected library is extremely widely deployed, but the impact is a recoverable crash and exploitation is conditional on application design.

An application uses Nodemailer to send email and accepts recipient addresses (to/cc/bcc) from an untrusted source such as a web form or API that passes JSON directly into the message options. An attacker submits a deeply nested JSON array in a recipient field; when Nodemailer performs recursive Array.toString() flattening, the call stack is exhausted and the Node.js process terminates. No public exploit code is identified, and the deep-nesting requirement plus dependence on the app forwarding raw input reflect the CVSS AC:H/AT:P complexity.