StackRadar

CVE-2026-100702

Medium

Advisory

Published 29 Sept 2026In the index since 30 Sept 2026
Severity
Medium
worst across findings
CVSS
5.9
base score, highest
EPSS
0.003
15th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
204
of 17,957 indexed, latest versions
Container images
188
deployed by those charts
Fix available
1 of 1
affected package

Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS

Carried by container images the latest versions of 204 of 17,957 indexed charts deploy, on 188 images.

Affected packageAffected versionsFixed inImages
nodemailernpm1.11.0, 2.7.2, 4.0.1, 4.6.8+52 more10.0.2188
OSV records
GHSA-8vvx-rff5-p5rq

Charts affected

204 by stars
ChartLatestAffected imagesRadar Score
twenty-crmvictorlane0.0.11 of 3See more

twenty-crm victorlane 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-100702.

Container imageDigestPackageFixed in
twentycrm/twenty:latest47bcefe4e497
nodemailer@9.1.1
10.0.2

Open the chart page →

74,963
wikiwener2.2.01 of 2See more

wiki wener 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-100702.

Container imageDigestPackageFixed in
requarks/wiki:latest68f0d1848261
nodemailer@6.9.1
10.0.2

Open the chart page →

4,129
wikiwikijs3.0.01 of 2See more

wiki wikijs 3.0.0

1 of the 2 container images this version deploys carry CVE-2026-100702.

Container imageDigestPackageFixed in
requarks/wiki:2af71a17dc27c
nodemailer@6.9.1
10.0.2

Open the chart page →

3,876
kibanawiremindVerified publisher8.5.241 of 2See more

kibana wiremind 8.5.24

1 of the 2 container images this version deploys carry CVE-2026-100702.

Container imageDigestPackageFixed in
library/kibana:8.19.2235544f1ff28a
nodemailer@9.0.4
10.0.2

Open the chart page →

1,405

Container images carrying it

188 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/data-fair/simple-directory:438a4f32fad82
nodemailer@5.0.0
10.0.2
1
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
nodemailer@6.9.16
10.0.2
1
ghcr.io/fluxerapp/fluxer-api:2026.820.164808f683541d5374
nodemailer@8.0.1
10.0.2
1
ghcr.io/harish2k01/portfolio-tracker:0.1.056efa3085895
nodemailer@7.0.13
10.0.2
1
ghcr.io/immich-app/immich-server:v3.2.4d317916b2809
nodemailer@9.0.5
10.0.2
1
ghcr.io/immich-app/immich-server:v2.3.1f8d06a32b1b2
nodemailer@7.0.10
10.0.2
1
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
nodemailer@7.0.4
10.0.2
1
ghcr.io/karakeep-app/karakeep:0.33.2b069e4307dec
nodemailer@7.0.13
10.0.2
1
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
nodemailer@7.0.4
10.0.2
1
ghcr.io/linkwarden/linkwarden:v2.16.30664c28a039b
nodemailer@9.0.4
10.0.2
1
ghcr.io/linkwarden/linkwarden:v2.5.398214faf09f7
nodemailer@6.9.3
10.0.2
1
ghcr.io/linuxserver/wikijs:version-2.5.20158d377933678
nodemailer@6.4.14
10.0.2
1
ghcr.io/logtide-dev/logtide-backend:1.0.265463e02f887
nodemailer@9.0.1
10.0.2
1
ghcr.io/logtide-dev/logtide-frontend:1.0.22a7da1451f86
nodemailer@9.0.1
10.0.2
1
ghcr.io/m9sweeper/dash:1.6.02e27cdff8344
nodemailer@6.9.3
10.0.2
1
ghcr.io/papra-hq/papra:26.6.2-rootlessa281cb44176d
nodemailer@9.0.1
10.0.2
1
ghcr.io/rajnandan1/kener:3.2.182b993cb232eb
nodemailer@6.10.0
10.0.2
1
ghcr.io/sct/overseerr:1.26.1254d16af8f71
nodemailer@6.6.0
10.0.2
1
ghcr.io/sct/overseerr:1.35.06197516c9d7b
nodemailer@6.8.0
10.0.2
1
ghcr.io/seerr-team/seerr:v3.5.027602401178d
nodemailer@6.10.0
10.0.2
1
ghcr.io/seerr-team/seerr:v3.2.0c4cbd5121236
nodemailer@6.10.0
10.0.2
1
ghcr.io/sredevopsorg/ghost-on-kubernetes:main06adb21bfdfc
nodemailer@10.0.1
10.0.2
1
ghcr.io/toeverything/affine:0.27.4b649f5ce2384
nodemailer@9.0.1
10.0.2
1
ghcr.io/wei-shaw/claude-relay-service:v1.1.292398c34934453
nodemailer@7.0.6
10.0.2
1
ghcr.io/wekan/wekan:v12.110c9b4e571cb9
nodemailer@8.0.11
10.0.2
1
ghcr.io/wundergraph/cosmo/controlplane:0.133.149800ff775f3
nodemailer@6.9.11
10.0.2
1
ghcr.io/xmv-solutions-gmbh/strapi:latesta288b4571142
nodemailer@8.0.11
10.0.2
1
public.ecr.aws/g4a0y2u8/unifie-store:staging-19925a2057fabc948
nodemailer@6.9.15
10.0.2
1
quay.io/ctrontesting/iofog-controller:latest10df27bc5560
nodemailer@5.1.1
10.0.2
1
quay.io/flomesh/flomesh-console-ubi8:0.70.0-30ce6938ff6709
nodemailer@6.5.0
10.0.2
1
quay.io/k3rnel-pan1c/uptime-kuma:1.19.3f975fde9329b
nodemailer@6.6.5
10.0.2
1
quay.io/mittwald/kube-mail:latest04f1099241fc
nodemailer@7.0.3
10.0.2
1
quay.io/rhdh/rhdh-hub-rhel9:latest4f8c0f8a8ee0
nodemailer@7.0.13
10.0.2
1
quay.io/seamware/onboarding:0.2.2b406475f9f00
nodemailer@7.0.12
10.0.2
1
quay.io/wekan/wekan:v5.65cb17600883a3
nodemailer@6.4.6
10.0.2
1
quay.io/wi_stefan/consent-manager:0.0.656399619568b
nodemailer@6.10.1
10.0.2
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
nodemailer@6.10.1
10.0.2
1
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-api-gateway:prodf8474a665b11
nodemailer@9.1.1
10.0.2
1

syft 1.42.1 · advisories as of 30 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.