Nodemailer 10.0.1 and earlier versions accept recursively nested arrays for recipient fields (to, cc, bcc) via the MimeNodeAddressInput type. The internal _parseAddresses() method only flattens the outermost array, leaving deeply nested arrays intact. These nested arrays are then passed to addressparser(), which uses a Tokenizer that coerces input to strings via Array.prototype.toString(), recursively joining nested arrays. This recursive stringification exhausts the V8 JavaScript engine call stack, causing a RangeError: Maximum call stack size exceeded. This exception occurs synchronously during the sendMail() API call before recipient limits are checked. If uncaught, the exception terminates the Node.js process handling mail, potentially causing denial of service through repeated malicious inputs. The vulnerability affects versions from 2.7.2 through 10.0.1 and is patched in 10.0.2.

An attacker able to supply recipient fields with deeply nested arrays can cause a stack exhaustion denial-of-service, crashing the Node.js process running Nodemailer. This can disrupt email sending services, especially those exposing recipient fields to attacker-controlled input without validation or nesting limits. The crash occurs before any network activity or email delivery, so no external dependencies are required. Uncaught exceptions lead to process termination, and repeated exploitation can cause persistent service unavailability due to restart loops.

A patch is available in Nodemailer version 10.0.2 that fixes this vulnerability. Users should upgrade to version 10.0.2 or later. Applications should also validate and flatten recipient arrays before passing them to Nodemailer or catch exceptions around the complete sendMail() invocation to prevent process termination. Explicit validation to reject deeply nested recipient arrays can mitigate this issue if upgrading is not immediately possible.