The flaw is a stack exhaustion vulnerability that occurs when Nodemailer processes deeply nested recipient arrays in the to, cc, and bcc fields. Instead of properly flattening the array structure, the library recursively calls Array.toString(), consuming the call stack and crashing the Node.js process. This results in a denial of service for any mail transport using affected versions of Nodemailer.

The vulnerability affects installations of Nodemailer prior to version 10.0.2. Any project that uses the nodemailer:nodemailer package without upgrading to 10.0.2 or later is susceptible.

The CVSS score of 8.2 indicates a high severity impact, while the EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog. An attacker can exploit this flaw by forging an email with a recipient array that is heavily nested, causing the mail server to crash. Because the flaw is invoked through normal email processing, the attack vector is likely remote via the SMTP or API interface, and it requires no special privileges.