GHSA-8vvx-rff5-p5rq

Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS

Published

2026-09-29

Modified

2026-09-29

Sources

github-advisory

Summary

## Submission metadata | Field | Value | |---|---| | Ecosystem | npm | | Package | `nodemailer` | | Repository | https://github.com/nodemailer/nodemailer | | Tested commit | `40d52215aac65b811d7e131bc916f68605efd9d2` | | Current tested version | `10.0.1` | | Confirmed vulnerable versions | `2.7.2`, `3.0.0`, `7.0.11`, `9.1.1`, `10.0.1` | | Proposed affected range | `>= 2.7.2, <= 10.0.1` | | Patched version | 10.0.2 | ## Summary Nodemailer 10.0.1 does not safely process deeply nested arrays supplied through recipient fields such as `to`, `cc`, and `bcc`. The public `MimeNodeAddressInput` type recursively permits arrays, but `MimeNode._parseAddresses()` flattens only the outermost array. A remaining nested array is passed to `addressparser()`, whose `Tokenizer` coerces the input with `.toString()`. Native `Array.prototype.toString()` recursively processes every nested array through `join()` and `toString()` until the V8 call stack is exhausted. A valid 10,021-byte JSON recipient value containing one address wrapped in 5,000 arrays causes: ```text RangeError: Maximum call stack size exceeded ``` The exception occurs through the normal `sendMail()` API before the `maxRecipients` limit is evaluated. If the integrating application does not catch the synchronous exception around the complete `sendMail()` invocation, the Node.js worker or server process terminates. No SMTP server, remote host, large attachment, or successful email delivery is required. This is distinct from GHSA-rcmh-qjqh-p98v / CVE-2025-14874. The previous vulnerability concerned recursive parsing of RFC 5322 group **strings**. This report uses Nodemailer's structured recipient-array input and never reaches the parser's `MAX_NESTED_GROUP_DEPTH` protection. ## Security impact An attacker who can control a recipient field passed to Nodemailer can trigger stack exhaustion using a roughly 10 KB JSON value. Potentially affected integrations include: - Email-sending HTTP APIs that accept structured recipient values. - Notification workers consuming JSON jobs from a queue. - Template or automation systems that forward parsed recipient data to `sendMail()`. - Multi-tenant applications that allow users to configure message recipients. When the exception is not caught, a single request or queue item can terminate the process handling mail. A process manager may restart the worker, but repeated malicious inputs can keep workers in a restart loop and make the service unavailable. Applications that explicitly validate recipient values as flat strings or flat arrays before calling Nodemailer are not exposed through this path. Applications that wrap the complete synchronous `sendMail()` invocation in exception handling can prevent process termination, although an attacker can still repeatedly force failed jobs. ## Attack prerequisites The vulnerability is reachable when: 1. An application accepts attacker-controlled or partially attacker-controlled recipient data. 2. The application preserves the array structure after parsing JSON. 3. The resulting value is passed to a Nodemailer recipient field such as `to`, `cc`, or `bcc`. 4. The application does not impose its own nesting-depth limit before calling Nodemailer. The proof of concept uses `jsonTransport` only to avoid requiring an SMTP server. The vulnerable address normalization and envelope construction occur before transport-specific delivery, so the root cause is not limited to `jsonTransport`. ## Technical details ### 1. The public input type accepts recursively nested arrays At `src/mime-node/index.ts:67`, recipient input is recursively defined: ```ts export type MimeNodeAddressInput = string | MimeNodeAddress | MimeNodeAddressInput[]; ``` Pinned source: https://github.com/nodemailer/nodemailer/blob/40d52215aac65b811d7e131bc916f68605efd9d2/src/mime-node/index.ts#L67 This permits values equivalent to: ```js [[[[['[email protected]']]]]] ``` ### 2. `_parseAddresses()` removes only the outermost array

Affected packages

Remediation: Upgrade to 10.0.2 or later.

References

• https://github.com/advisories/GHSA-8vvx-rff5-p5rq