Nodemailer: Process-global DNS cache reuses TLS `servername` across transports, enabling cross-tenant SMTP credential disclosure
### Summary Nodemailer's process-global DNS cache is keyed only by `host`, but each cache entry also stores the caller-specific TLS `servername`. When two direct SMTPS transports use the same DNS host with different `tls.servername` values, the first transport's server name is returned to the second transport and overwrites its explicitly configured value. As a result, Nodemailer sends the wrong SNI value and verifies the peer certificate against the wrong identity. In a multi-tenant service or SNI-routed SMTP gateway, one tenant can prime the cache so that a victim transport connects to the attacker's TLS virtual host, accepts the attacker's certificate with `rejectUnauthorized: true`, and sends the victim's SMTP credentials to it. ## Affected component - **Ecosystem:** npm - **Package:** `nodemailer` - **Repository:** https://github.com/nodemailer/nodemailer - **Tested version:** `10.0.1` - **Tested commit:** `40d52215aac65b811d7e131bc916f68605efd9d2` - **Runtime-confirmed vulnerable versions:** `5.0.0` and `10.0.1` - **Affected versions:** `>= 5.0.0, <= 10.0.1` - **Patched versions:** None known at the time of this report - **Affected mode:** Direct TLS/SMTPS connections (`secure: true`) where different transports use the same non-IP `host` and different TLS `servername` values The vulnerable cache implementation was introduced in commit `6859b5dd96c8d9f0070a3169a877181b71df4a3b` on 2018-12-28. Git history shows `v5.0.0` as the first release tag containing that commit. The
GHSA-6vj9-mwq6-2f5v
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GHSA-6vj9-mwq6-2f5v
nodemailer
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 10.0.2
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "5.0.0"
},
{
"fixed": "10.0.2"
}
]
}
],
"package": {
"name": "nodemailer",
"purl": "pkg:npm/nodemailer",
"ecosystem": "npm"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-6vj9-mwq6-2f5v/GHSA-6vj9-mwq6-2f5v.json"
}
}
]- Related CVEs
- CVE-2026-100701
Source reference:
/aliases
Publisher severity
No explicit severity was provided.
- Event
- #23692 · Revision 1
- Added to Heist Feed
- Publisher date