CVE WATCH / VULNERABILITY DETAIL
CVE-2026-100702
MEDIUMCVSS 5.9NVD feed
Published 26 September 2026 · tracked since 27 September 2026
Description
Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, allowing attackers to cause stack exhaustion. Attackers can supply a deeply nested JSON recipient array that triggers recursive Array.toString() conversion, exhausting the call stack
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-119303 MEDIUM 5.3
- CVE-2026-119035 MEDIUM 6.4
- CVE-2026-119034 MEDIUM 5.3
- CVE-2026-119032 MEDIUM 5.3
- CVE-2026-118439 MEDIUM 4.1
- CVE-2026-118420 MEDIUM 6.8
- CVE-2026-118418 MEDIUM 5.3
- CVE-2026-118041 HIGH 8.8
- CVE-2026-117523 MEDIUM 4.3
- CVE-2026-117522 MEDIUM 6.8