CVE-2026-100702

Executive Summary

CVE-2026-100702 is a denial-of-service vulnerability in Nodemailer versions before 10.0.2, where deeply nested arrays supplied in recipient fields (to, cc, bcc) are not properly flattened, causing recursive Array.toString() conversion that exhausts the call stack. Any Node.js application that passes untrusted input into these recipient fields (e.g., via a web form, API endpoint, or message queue) is affected. Successful exploitation terminates the Node.js process, resulting in service unavailability, though there is no impact to confidentiality or integrity (CVSS 5.9, A:H).

Technical Analysis

Nodemailer is a widely used Node.js library for sending email. The vulnerability lies in the recipient-parsing logic that accepts to, cc, and bcc fields. Per the NVD description, the library "fails to properly flatten deeply nested arrays in recipient fields." When an attacker supplies a recipient value structured as a deeply nested JSON array (arrays within arrays within arrays, arbitrarily deep), Nodemailer's processing path triggers a recursive Array.toString() conversion. Standard JavaScript engine behavior performs this array-to-string conversion recursively; each nesting level consumes a stack frame. With sufficient nesting depth, the recursion exhausts the Node.js call stack, raising an uncatchable RangeError: Maximum call stack size exceeded, which terminates the Node.js process.

The vulnerability class is CWE-674 (Uncontrolled Recursion). The attack is delivered as data — a nested-array structure inside a recipient field — rather than via malformed network framing. The attack surface is any application code path that accepts external input and passes it, unvalidated and unbounded, into Nodemailer's to, cc, or bcc handling. Typical exposure points include public-facing contact/registration forms, password-reset flows, notification APIs, and any endpoint that forwards user-controlled recipient lists to Nodemailer.

The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates a remote, unauthenticated vector requiring some conditions for success (AC:H), with high availability impact and no confidentiality or integrity impact.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-674) and the NVD description. No function names, endpoints, or parameters beyond those in the NVD description (to, cc, bcc, Array.toString()) are asserted.

1. Reconnaissance / target identification: The attacker identifies a target application that accepts an email recipient value from an untrusted source and routes it into Nodemailer. This is commonly a form field, a JSON API body field, or a queued job payload. Fingerprinting may involve observing error pages, response headers, or behavior consistent with a Node.js/Nodemailer backend.

2. Triggering the flaw class: The attacker submits a recipient value constructed as a deeply nested JSON array (nested arrays within arrays) in a to, cc, or bcc field. Because the library does not flatten or depth-limit the structure before conversion, the nested array is passed through to a recursive Array.toString() conversion.

3. Payload/execution at the class level: The depth of nesting is chosen to exceed the available call stack. When the recursive conversion runs, the stack is exhausted, producing a RangeError: Maximum call stack size exceeded. Depending on how the application handles (or fails to handle) this exception, the Node.js process may terminate.

4. Post-exploitation impact: The result is availability loss — process termination and potential service outage or restart loops. There is no code execution, no data exfiltration, and no integrity impact reported. An attacker could repeat submissions to sustain an outage (resource exhaustion / DoS).

Impact Assessment

The primary impact is availability (CVSS A:H). Because Nodemailer is a dependency of many Node.js applications, the blast radius is broad: any service that processes untrusted recipient input is potentially affected. Successful exploitation can crash the Node.js process, causing request failures, dropped sessions, failed background jobs, and, if the process is supervised, potential crash-restart churn. Confidentiality (C:N) and integrity (I:N) are unaffected. The scope is unchanged (S:U), and exploitation is unauthenticated (PR:N) but conditionally achievable (AC:H), reflecting the need for the application to route attacker-controlled nested-array input into the recipient fields.

Detection Guidance

Sigma Rule

title: Nodemailer Deeply Nested Recipient Array DoS Attempt (CVE-2026-100702)
id: 3f8b2c41-9a7e-4d1c-b0a2-6c5e1f7a9d21
status: experimental
description: Detects submission of deeply nested JSON arrays in recipient fields (to/cc/bcc) targeting Nodemailer < 10.0.2.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100702
author: Threat Intelligence
date: 2026-01-01
logsource:
  category: webserver
detection:
  keywords_recipient:
    - 'to'
    - 'cc'
    - 'bcc'
  nested_array_pattern:
    - '[[['
    - '[[[['
    - '[[[[['
  condition: keywords_recipient and nested_array_pattern
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
falsepositives:
  - Legitimate bulk email APIs accepting structured recipient data
level: medium
tags:
  - attack.t1499
  - cve.2026-100702

YARA Rule

rule CVE_2026_100702_Nodemailer_Nested_Recipient_DoS
{
    meta:
        description = "Detects deeply nested recipient arrays targeting Nodemailer < 10.0.2 (CVE-2026-100702)"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100702"
        severity = "medium"

    strings:
        $field_to  = "to" nocase
        $field_cc  = "cc" nocase
        $field_bcc = "bcc" nocase
        $nest3 = "[[["
        $nest4 = "[[[["
        $nest5 = "[[[[["

    condition:
        ($field_to or $field_cc or $field_bcc) and
        ($nest3 or $nest4 or $nest5)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100702 Nodemailer Deeply Nested Recipient Array DoS Attempt"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"bcc" nocase; http.request_body; pcre:"/\[{4,}/"; reference:cve,2026-100702; classtype:attempted-dos; sid:2026100702; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=10s
  [network where http.request.method == "POST" and
     http.request.body.content : ("*to*" or "*cc*" or "*bcc*")]
  [network where http.request.body.content : "*[[[[*"]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nodejs
| search (uri_query="*to=*" OR uri_query="*cc=*" OR uri_query="*bcc=*" OR form_data="*bcc=*")
| regex form_data="\[{4,}|uri_query="\[{4,}"
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_path, uri_query
| where count >= 1
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - count

Wazuh OSSEC Rule

<group name="web,nodemailer,cve_2026_100702">
  <rule id="100702" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">\.(to|cc|bcc)=</field>
    <regex>\[{4,}</regex>
    <description>CVE-2026-100702: Nodemailer deeply nested recipient array DoS attempt detected</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

• Upgrade Nodemailer to 10.0.2 or later, which addresses the nested-array flattening failure (confidence 0/4 — verify against the project's release notes before relying on this claim).
• Until upgrade, validate and sanitize all recipient input: reject or truncate deeply nested or non-scalar recipient values, and enforce a maximum nesting depth and array length before values reach Nodemailer.
• Restrict who can supply recipient fields; require authentication and rate-limit endpoints that forward recipient input.
• Run Node.js processes under a supervisor with restart policies, and add stack-size awareness to crash monitoring (e.g., alert on RangeError: Maximum call stack size exceeded).

2. Patch/upgrade steps:

• Pin Nodemailer to >= 10.0.2 in package.json / lockfiles and rebuild.
• Run dependency scanning (npm audit, SCA tooling) to confirm no residual vulnerable versions.
• Re-test recipient-handling flows in staging before production rollout.

3. Long-term hardening:

• Adopt input validation at trust boundaries, enforcing schema constraints (depth, type, length) for all externally sourced values.
• Add depth/impact guards in email-sending paths and treat recipient input as untrusted by default.
• Monitor dependency advisories continuously and track CVE-2026-100702 for vendor patch confirmation.

References

• NVD — CVE-2026-100702: https://nvd.nist.gov/vuln/detail/CVE-2026-100702
• CWE-674 (Uncontrolled Recursion): https://cwe.mitre.org/data/definitions/674.html
• Nodemailer project: https://nodemailer.com/
• CISA Known Exploited Vulnerabilities catalog (check for CVE-2026-100702): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• No public PoC, exploit code, or CISA KEV entry was identified in the provided data; no threat actor campaigns or exploit-in-the-wild evidence is available at this time.