GHSA-8vvx-rff5-p5rq: Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS

Nodemailer 10.0.1 does not safely process deeply nested arrays supplied through recipient fields such as to, cc, and bcc.

The public MimeNodeAddressInput type recursively permits arrays, but MimeNode._parseAddresses() flattens only the outermost array. A remaining nested array is passed to addressparser(), whose Tokenizer coerces the input with .toString(). Native Array.prototype.toString() recursively processes every nested array through join() and toString() until the V8 call stack is exhausted.

A valid 10,021-byte JSON recipient value containing one address wrapped in 5,000 arrays causes:

RangeError: Maximum call stack size exceeded

The exception occurs through the normal sendMail() API before the maxRecipients limit is evaluated. If the integrating application does not catch the synchronous exception around the complete sendMail() invocation, the Node.js worker or server process terminates.

No SMTP server, remote host, large attachment, or successful email delivery is required.

This is distinct from GHSA-rcmh-qjqh-p98v / CVE-2025-14874. The previous vulnerability concerned recursive parsing of RFC 5322 group strings. This report uses Nodemailer’s structured recipient-array input and never reaches the parser’s MAX_NESTED_GROUP_DEPTH protection.