CVE-2026-100702

5.9 MEDIUMpublic exploit available

Published 2026-09-26 · Updated 2026-09-27

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, allowing attackers to cause stack exhaustion. Attackers can supply a deeply nested JSON recipient array that triggers recursive Array.toString() conversion, exhausting the call stack and terminating the Node.js process.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CWE-674

Public exploit & PoC references

https://github.com/nodemailer/nodemailer/security/advisories/GHSA-8vvx-rff5-p5rq

All references

https://github.com/nodemailer/nodemailer/security/advisories/GHSA-8vvx-rff5-p5rq
https://www.vulncheck.com/advisories/nodemailer-before-10.0.2-stack-exhaustion-via-nested-recipient-arrays

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2026-102265PoC
HIGHCVE-2026-102276PoC
HIGHCVE-2026-102278PoC
HIGHCVE-2026-102281PoC
HIGHCVE-2026-102495
HIGHCVE-2026-102496
HIGHCVE-2026-102497
UNSCOREDCVE-2026-103087PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.