CVE-2026-100702 Nodemailer before 10.0.2 Stack Exhaustion via Nested Recipient Arrays
Attackers can crash the Node.js process by sending deeply nested recipient arrays, causing stack exhaustion in the Nodemailer library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-100702?
CVE-2026-100702 is a high-severity denial of service vulnerability in nodemailer, published on 26 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, allowing attackers to cause stack exhaustion. Attackers can supply a deeply nested JSON recipient array that triggers recursive Array.toString() conversion, exhausting the call stack and terminating the Node.js process.
Weakness: CWE-674
Which versions are affected by CVE-2026-100702?
2 open source packages ship an affected version, including nodemailer.
| Package | Affected | Fixed in |
|---|---|---|
nodemailer npm | All versions | 10.0.2 |
nodemailer npm | All versions | 10.0.2 |
How do I fix CVE-2026-100702?
Upgrade nodemailer to 10.0.2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-100702 being exploited?
There is no known exploitation of CVE-2026-100702 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-EE74509, CLEANSTART-2026-VD48874, CLSA-2026-1790718876, CLSA-2026-1790803367, CLSA-2026-1790876521, DEBIAN-CVE-2026-100702 and 19 more.