Is CVE-2026-100702 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-100702?

CVE-2026-100702 has a CVSS v3 severity of MEDIUM (5.9).

Back

CVE-2026-100702

Description

Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, allowing attackers to cause stack exhaustion. Attackers can supply a deeply nested JSON recipient array that triggers recursive Array.toString() conversion, exhausting the call stack and terminating the Node.js process.