npm/nodemailer CVE-2026-100702: medium 5.9, EPSS 0.25%
Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS
Action: Upgrade nodemailer to 10.0.2 or later.
npm i nodemailer@10.0.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 10.0.2 | - |
Fixed versions
| 10.0.2 |
Sources
- osv: GHSA-8vvx-rff5-p5rq
- https://github.com/nodemailer/nodemailer/security/advisories/GHSA-8vvx-rff5-p5rq
- https://github.com/nodemailer/nodemailer/commit/ebe084940aef88278afc6016b78c6d1c3821bb66
- https://github.com/nodemailer/nodemailer
- https://github.com/nodemailer/nodemailer/releases/tag/v10.0.2
CVE-2026-100702 · published · modified · JSON