CVE-2026-100702
MediumAdvisory
Published 29 Sept 2026In the index since 30 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 5.9
- base score, highest
- EPSS
- 0.003
- 15th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 204
- of 17,957 indexed, latest versions
- Container images
- 188
- deployed by those charts
- Fix available
- 1 of 1
- affected package
Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS
Carried by container images the latest versions of 204 of 17,957 indexed charts deploy, on 188 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| nodemailernpm | 1.11.0, 2.7.2, 4.0.1, 4.6.8+52 more | 10.0.2 | 188 |
- OSV records
- GHSA-8vvx-rff5-p5rq
Charts affected
204 by stars
Container images carrying it
188 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| joplin/ | 3f7b852959aa | nodemailer | 10.0.2 | 3 |
| pantsel/ | c8172b75607d | nodemailer | 10.0.2 | 3 |
| rcdelacruz/ | 38007f358355 | nodemailer | 10.0.2 | 3 |
| ghcr.io/ | a4a3639899f7 | nodemailer | 10.0.2 | 3 |
| quay.io/ | 709c7da19c5a | nodemailer | 10.0.2 | 3 |
| governify/ | d3f37f4f8168 | nodemailer | 10.0.2 | 2 |
| hoppscotch/ | f1da831950b7 | nodemailer | 10.0.2 | 2 |
| kutt/ | fa3d24a89b04 | nodemailer | 10.0.2 | 2 |
| library/ | 90592b712b6b | nodemailer | 10.0.2 | 2 |
| louislam/ | 917318f9d7be | nodemailer | 10.0.2 | 2 |
| louislam/ | 96510915e6be | nodemailer | 10.0.2 | 2 |
| louislam/ | 9aeb4e51d038 | nodemailer | 10.0.2 | 2 |
| louislam/ | a8610b3b4c38 | nodemailer | 10.0.2 | 2 |
| louislam/ | c74379ac4509 | nodemailer | 10.0.2 | 2 |
| moreillon/ | e1c9bfab5c16 | nodemailer | 10.0.2 | 2 |
| n8nio/ | 14c4285bc303 | nodemailer | 10.0.2 | 2 |
| outlinewiki/ | d060dcd8f9aa | nodemailer | 10.0.2 | 2 |
| rajnandan1/ | 30407afca731 | nodemailer | 10.0.2 | 2 |
| requarks/ | 68f0d1848261 | nodemailer | 10.0.2 | 2 |
| ghcr.io/ | 180acad33d69 | nodemailer | 10.0.2 | 2 |
| ghcr.io/ | 6432d1dc5895 | nodemailer | 10.0.2 | 2 |
| ghcr.io/ | b434cb9287ee | nodemailer | 10.0.2 | 2 |
| ghcr.io/ | f4768de5f616 | nodemailer | 10.0.2 | 2 |
| activepieces/ | 58414dfc94c4 | nodemailer | 10.0.2 | 1 |
| activepieces/ | a12efde0c535 | nodemailer | 10.0.2 | 1 |
| activepieces/ | c26188b44e62 | nodemailer | 10.0.2 | 1 |
| assistiot/ | 0570b27bb7c2 | nodemailer | 10.0.2 | 1 |
| automatischio/ | 3bace7a12d5f | nodemailer | 10.0.2 | 1 |
| bnjbvr/ | 37e216b182c8 | nodemailer | 10.0.2 | 1 |
| budibase/ | 44fe6feab985 | nodemailer | 10.0.2 | 1 |
| budibase/ | de5e2e560ce8 | nodemailer | 10.0.2 | 1 |
| chocobozzz/ | 052712130691 | nodemailer | 10.0.2 | 1 |
| cnieg/ | 98ee05668915 | nodemailer | 10.0.2 | 1 |
| countly/ | f4cc7447c4f5 | nodemailer | 10.0.2 | 1 |
| countly/ | e3c238248f99 | nodemailer | 10.0.2 | 1 |
| countly/ | 2acbc11499b6 | nodemailer | 10.0.2 | 1 |
| devopsiaci/ | d9441c931f75 | nodemailer | 10.0.2 | 1 |
| directus/ | 9c8470ea465c | nodemailer | 10.0.2 | 1 |
| directus/ | e3c8bb975350 | nodemailer | 10.0.2 | 1 |
| diygod/ | 7a6312cac0d5 | nodemailer | 10.0.2 | 1 |
| docmost/ | b56947fcfd08 | nodemailer | 10.0.2 | 1 |
| drumsergio/ | c6afb6679301 | nodemailer | 10.0.2 | 1 |
| fallenbagel/ | 4538137bc5af | nodemailer | 10.0.2 | 1 |
| fallenbagel/ | 6dcdb5ba5091 | nodemailer | 10.0.2 | 1 |
| fallenbagel/ | a324fa4d81cc | nodemailer | 10.0.2 | 1 |
| fiware/ | a1b6ed4ae84f | nodemailer | 10.0.2 | 1 |
| fonoster/ | e8c84b5eaa67 | nodemailer | 10.0.2 | 1 |
| fonoster/ | 5f8f380dc174 | nodemailer | 10.0.2 | 1 |
| fonoster/ | 051ba9c34ef5 | nodemailer | 10.0.2 | 1 |
| fonoster/ | e4d5f5ff1945 | nodemailer | 10.0.2 | 1 |