Description

Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, allowing attackers to cause stack exhaustion. Attackers can supply a deeply nested JSON recipient array that triggers recursive Array.toString() conversion, exhausting the call stack and terminating the Node.js process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-09-26T14:16:55.280Z",
  "pubdate": "2026-09-26T14:16:55.280Z",
  "executiveSummary": "Nodemailer versions prior to 10.0.2 are susceptible to a stack exhaustion vulnerability originating from improper handling of deeply nested arrays within recipient fields (to, cc, bcc).\nThe vulnerability is classified as a resource exhaustion issue, which can be triggered by providing a malicious, deeply nested JSON structure during the mail composition process.\nThe primary impact of this flaw is a Denial of Service (DoS) condition, as the recursive processing of these arrays forces the Node.js process to exceed the maximum call stack size, resulting in immediate process termination.\nThis vulnerability is particularly concerning in applications where recipient data is sourced from user-provided or untrusted inputs, as it requires no prior authentication to exploit.\nThe risk implication is significant for availability, as an unauthenticated attacker can effectively crash the underlying Node.js service, leading to service disruption.\nExploitation is straightforward, requiring only the submission of a specifically crafted JSON array payload to the affected recipient fields, necessitating an upgrade to the patched version as the primary remediation strategy.",
  "technicalDetails": "The vulnerability resides within the internal input sanitization and flattening logic of the Nodemailer package, specifically in how it processes recipient arrays for the to, cc, and bcc fields.\nThe root cause is the utilization of recursive logic that invokes Array.toString() on deeply nested data structures without implementing depth limiting or iterative flattening techniques.\nWhen a recipient field is populated with a recursive or highly nested JSON array, the application attempts to process this structure recursively. As the recursion depth increases, the call stack grows proportionally to accommodate the execution context of each nested element.\nOnce the depth exceeds the pre-configured V8 engine stack limit, a RangeError: Maximum call stack size exceeded is thrown. Because this error occurs during the execution of a synchronous recursive routine, the event loop becomes blocked, and the Node.js runtime environment terminates the process to prevent further memory corruption or undefined state behavior.\nAn attacker can exploit this by crafting a malicious JSON payload where the recipient field contains a deeply nested array structure, such as [ [ [ ... [ [ 'attacker@example.com' ] ] ... ] ] ].\nUpon ingestion of this payload, the Nodemailer logic triggers a recursive traversal of the array to flatten the data for transmission or address validation. This traversal forces the call stack to exhaust as the engine attempts to resolve each nested array object string representation.\nThe attack is network-exposed, provided the application accepts structured JSON input for email recipients from external sources without prior validation or schema enforcement.\nNo authentication or specific privileges are required to initiate the attack; the mere ingestion of the malicious object by the vulnerable function is sufficient to force process termination.\nThe post-exploitation impact is a definitive service outage. Because Node.js processes are typically managed by process managers like PM2 or systemd, continuous exploitation can lead to a state of perpetual service restart loops, effectively rendering the mail functionality unusable.\nThis vulnerability highlights the dangers of using unbounded recursive calls when processing input formats like JSON, where nested structures can be weaponized to manipulate runtime resource allocation."
}