https://vulnerability.circl.lu/sightings/feed 2026-10-11T23:02:45.743189+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/7e672a33-67c7-4e0b-9bd3-3b699002f98a/export 2026-10-11T23:02:45.751650+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "7e672a33-67c7-4e0b-9bd3-3b699002f98a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-8VVX-RFF5-P5RQ", "type": "seen", "source": "https://gist.github.com/alon710/47313a263844046be3d90ea55db50da3", "content": "# GHSA-8VVX-RFF5-P5RQ: GHSA-8vvx-rff5-p5rq: Stack Exhaustion Denial of Service via Nested Recipient Arrays in Nodemailer\n\n> **CVSS Score:** 5.9\n> **Published:** 2026-09-29\n> **Full Report:** https://cvereports.com/reports/GHSA-8VVX-RFF5-P5RQ\n\n## Summary\nAn uncontrolled recursion vulnerability exists in Nodemailer versions up to and including 10.0.1. When parsing recipient email addresses, recursively nested arrays bypass the parser's depth limit, resulting in V8 call stack exhaustion and immediate synchronous process termination.\n\n## TL;DR\nNodemailer versions <= 10.0.1 are vulnerable to a synchronous Denial of Service crash. Sending deeply nested arrays in recipient fields (such as 'to') causes a stack overflow in the V8 engine, crashing the application.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-674\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 5.9 (Medium)\n- **Impact**: Denial of Service (DoS) via Stack Exhaustion\n- **Exploit Status**: PoC Available\n- **KEV Status**: Not Listed\n- **Vulnerable Component**: MimeNode._parseAddresses / addressparser\n\n## Affected Systems\n\n- Nodemailer npm package\n\n## Mitigation\n\n- Upgrade Nodemailer to version 10.0.2 or higher to ensure native iterative array processing.\n- Enforce rigorous schema validation (e.g., Zod or Joi) on incoming API requests to reject multi-dimensional or nested array structures.\n- Pre-flatten and sanitize recipient lists in application space before invoking sendMail.\n\n**Remediation Steps:**\n1. Run 'npm install nodemailer@10.0.2' or 'npm update nodemailer' to retrieve the patched version.\n2. Review code entry points where email endpoints receive inputs, implementing input filters that ensure 'to', 'cc', and 'bcc' properties are strictly flat arrays of valid email strings or simple strings.\n3. Verify the application handles downstream asynchronous processing exceptions correctly.\n\n## References\n\n- [GitHub Advisory: GHSA-8vvx-rff5-p5rq](https://github.com/advisories/GHSA-8vvx-rff5-p5rq)\n- [Nodemailer Security Advisory](https://github.com/nodemailer/nodemailer/security/advisories/GHSA-8vvx-rff5-p5rq)\n- [Fix Commit](https://github.com/nodemailer/nodemailer/commit/ebe084940aef88278afc6016b78c6d1c3821bb66)\n- [Release v10.0.2](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.2)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-8VVX-RFF5-P5RQ) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-29T21:30:30.000000Z"} 2026-09-29T21:30:30+00:00