AIKIDO-2026-645479

TL;DR

Nodemailer's MimeNode._parseAddresses flattened only the outermost layer of recipient arrays in to, cc, and bcc, then handed any still-nested array to addressparser, which stringifies it. The native array-to-string conversion recurses once per nesting level, so a deeply nested or self-referential recipient value exhausts the V8 call stack and throws RangeError: Maximum call stack size exceeded before the maxRecipients limit applies. The uncaught throw escaped sendMail and could terminate the Node.js process. The fix walks arrays iteratively with a cycle guard and routes compile-time errors to the callback.