Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: nodemailer 10.0.2 Clear all filters
TI-2026-64858 CVE-2026-100702 · GHSA-5hcf-56h7-4fvx

Nodemailer before 10.0.2 Stack Exhaustion via Nested Recipient Arrays

Priority LOW 35

Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, allowing attackers to cause stack exhaustion.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.0025 Published 2026-09-26 Partial fix · 10.0.2 CWE-674
TI-2026-64857 CVE-2026-100701 · GHSA-2mg4-38wg-2h6f

Nodemailer 5.0.0 through 10.0.1 TLS servername Cache Confusion

Priority LOW 26

Nodemailer versions 5.0.0 through 10.0.1 use a process-global DNS cache that is keyed only by the DNS host, while each cache entry also stores the caller-specific TLS servername.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00114 Published 2026-09-26 Partial fix · 10.0.2 CWE-295