UnratedFix available

DEBIAN-CVE-2026-100701

Type: advisorySource: OSV1 source record

Nodemailer versions 5.0.0 through 10.0.1 use a process-global DNS cache that is keyed only by the DNS host, while each cache entry also stores the caller-specific TLS servername. When two direct TLS/SMTPS transports (secure: true) resolve the same non-IP host with different tls.servername values, the first transport's servername is returned on the cache hit and overwrites the second transport's explicitly configured value, so Nodemailer sends the wrong SNI value and validates the peer certificate against the wrong identity. In multi-tenant services or SNI-routed SMTP gateways, an attacker who can prime the cache can cause a victim transport to connect to the attacker's TLS virtual host and accept the attacker's certificate even with rejectUnauthorized: true, disclosing the victim's SMTP credentials. Fixed in 10.0.2.

Announced 26 Sept 2026Source revision 1

Original source ↗

DEBIAN-CVE-2026-100701

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:DEBIAN-CVE-2026-100701

node-nodemailer

Source reference: /affected/0/package/name

Affected versions: 10.0.0+~8.0.1-1
Source reference: /affected/0/versions
10.0.10+~8.0.1-1
Source reference: /affected/0/versions
10.0.10+~8.0.2-1
Source reference: /affected/0/versions
6.10.0+~6.4.17-1
Source reference: /affected/0/versions
6.8.0+~6.4.6-1
Source reference: /affected/0/versions
6.9.13+~6.4.14-1
Source reference: /affected/0/versions
6.9.15+~6.4.16-1
Source reference: /affected/0/versions
6.9.16+~6.4.16-1
Source reference: /affected/0/versions
6.9.4+~6.4.9-1
Source reference: /affected/0/versions
6.9.4+~6.4.9-2
Source reference: /affected/0/versions
6.9.4+~6.4.9-3
Source reference: /affected/0/versions
6.9.4+~6.4.9-4
Source reference: /affected/0/versions
7.0.10+~7.0.2-1
Source reference: /affected/0/versions
7.0.12+~7.0.5-1
Source reference: /affected/0/versions
7.0.5+~7.0.1-1
Source reference: /affected/0/versions
7.0.6+~7.0.1-1
Source reference: /affected/0/versions
7.0.9+~7.0.2-1
Source reference: /affected/0/versions
7.0.9+~7.0.2-2
Source reference: /affected/0/versions
8.0.11+~8.0.1-1
Source reference: /affected/0/versions
8.0.2+~7.0.11-1
Source reference: /affected/0/versions
8.0.3+~7.0.11-1
Source reference: /affected/0/versions
8.0.4+~7.0.11-1
Source reference: /affected/0/versions
8.0.4+~7.0.11-2
Source reference: /affected/0/versions
9.0.0+~8.0.1-1
Source reference: /affected/0/versions
9.0.3+~8.0.1-1
Source reference: /affected/0/versions
9.0.5+~8.0.1-1
Source reference: /affected/0/versions
9.0.6+~8.0.1-1
Source reference: /affected/0/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

node-nodemailer

Source reference: /affected/1/package/name

Affected versions: 10.0.0+~8.0.1-1
Source reference: /affected/1/versions
10.0.10+~8.0.1-1
Source reference: /affected/1/versions
10.0.10+~8.0.2-1
Source reference: /affected/1/versions
6.10.0+~6.4.17-1
Source reference: /affected/1/versions
6.10.0+~6.4.17-1+deb13u1
Source reference: /affected/1/versions
7.0.10+~7.0.2-1
Source reference: /affected/1/versions
7.0.12+~7.0.5-1
Source reference: /affected/1/versions
7.0.5+~7.0.1-1
Source reference: /affected/1/versions
7.0.6+~7.0.1-1
Source reference: /affected/1/versions
7.0.9+~7.0.2-1
Source reference: /affected/1/versions
7.0.9+~7.0.2-2
Source reference: /affected/1/versions
8.0.11+~8.0.1-1
Source reference: /affected/1/versions
8.0.2+~7.0.11-1
Source reference: /affected/1/versions
8.0.3+~7.0.11-1
Source reference: /affected/1/versions
8.0.4+~7.0.11-1
Source reference: /affected/1/versions
8.0.4+~7.0.11-2
Source reference: /affected/1/versions
9.0.0+~8.0.1-1
Source reference: /affected/1/versions
9.0.3+~8.0.1-1
Source reference: /affected/1/versions
9.0.5+~8.0.1-1
Source reference: /affected/1/versions
9.0.6+~8.0.1-1
Source reference: /affected/1/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

node-nodemailer

Source reference: /affected/2/package/name

Affected versions: 10.0.0+~8.0.1-1
Source reference: /affected/2/versions
6.10.0+~6.4.17-1
Source reference: /affected/2/versions
7.0.10+~7.0.2-1
Source reference: /affected/2/versions
7.0.12+~7.0.5-1
Source reference: /affected/2/versions
7.0.5+~7.0.1-1
Source reference: /affected/2/versions
7.0.6+~7.0.1-1
Source reference: /affected/2/versions
7.0.9+~7.0.2-1
Source reference: /affected/2/versions
7.0.9+~7.0.2-2
Source reference: /affected/2/versions
8.0.11+~8.0.1-1
Source reference: /affected/2/versions
8.0.2+~7.0.11-1
Source reference: /affected/2/versions
8.0.3+~7.0.11-1
Source reference: /affected/2/versions
8.0.4+~7.0.11-1
Source reference: /affected/2/versions
8.0.4+~7.0.11-2
Source reference: /affected/2/versions
9.0.0+~8.0.1-1
Source reference: /affected/2/versions
9.0.3+~8.0.1-1
Source reference: /affected/2/versions
9.0.5+~8.0.1-1
Source reference: /affected/2/versions
9.0.6+~8.0.1-1
Source reference: /affected/2/versions
Fixed versions: 10.0.10+~8.0.1-1
Source reference: /affected/2/ranges
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "node-nodemailer",
      "purl": "pkg:deb/debian/node-nodemailer?arch=source&distro=bookworm",
      "ecosystem": "Debian:12"
    },
    "versions": [
      "10.0.0+~8.0.1-1",
      "10.0.10+~8.0.1-1",
      "10.0.10+~8.0.2-1",
      "6.10.0+~6.4.17-1",
      "6.8.0+~6.4.6-1",
      "6.9.13+~6.4.14-1",
      "6.9.15+~6.4.16-1",
      "6.9.16+~6.4.16-1",
      "6.9.4+~6.4.9-1",
      "6.9.4+~6.4.9-2",
      "6.9.4+~6.4.9-3",
      "6.9.4+~6.4.9-4",
      "7.0.10+~7.0.2-1",
      "7.0.12+~7.0.5-1",
      "7.0.5+~7.0.1-1",
      "7.0.6+~7.0.1-1",
      "7.0.9+~7.0.2-1",
      "7.0.9+~7.0.2-2",
      "8.0.11+~8.0.1-1",
      "8.0.2+~7.0.11-1",
      "8.0.3+~7.0.11-1",
      "8.0.4+~7.0.11-1",
      "8.0.4+~7.0.11-2",
      "9.0.0+~8.0.1-1",
      "9.0.3+~8.0.1-1",
      "9.0.5+~8.0.1-1",
      "9.0.6+~8.0.1-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-100701.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "node-nodemailer",
      "purl": "pkg:deb/debian/node-nodemailer?arch=source&distro=trixie",
      "ecosystem": "Debian:13"
    },
    "versions": [
      "10.0.0+~8.0.1-1",
      "10.0.10+~8.0.1-1",
      "10.0.10+~8.0.2-1",
      "6.10.0+~6.4.17-1",
      "6.10.0+~6.4.17-1+deb13u1",
      "7.0.10+~7.0.2-1",
      "7.0.12+~7.0.5-1",
      "7.0.5+~7.0.1-1",
      "7.0.6+~7.0.1-1",
      "7.0.9+~7.0.2-1",
      "7.0.9+~7.0.2-2",
      "8.0.11+~8.0.1-1",
      "8.0.2+~7.0.11-1",
      "8.0.3+~7.0.11-1",
      "8.0.4+~7.0.11-1",
      "8.0.4+~7.0.11-2",
      "9.0.0+~8.0.1-1",
      "9.0.3+~8.0.1-1",
      "9.0.5+~8.0.1-1",
      "9.0.6+~8.0.1-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-100701.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "10.0.10+~8.0.1-1"
          }
        ]
      }
    ],
    "package": {
      "name": "node-nodemailer",
      "purl": "pkg:deb/debian/node-nodemailer?arch=source&distro=forky",
      "ecosystem": "Debian:14"
    },
    "versions": [
      "10.0.0+~8.0.1-1",
      "6.10.0+~6.4.17-1",
      "7.0.10+~7.0.2-1",
      "7.0.12+~7.0.5-1",
      "7.0.5+~7.0.1-1",
      "7.0.6+~7.0.1-1",
      "7.0.9+~7.0.2-1",
      "7.0.9+~7.0.2-2",
      "8.0.11+~8.0.1-1",
      "8.0.2+~7.0.11-1",
      "8.0.3+~7.0.11-1",
      "8.0.4+~7.0.11-1",
      "8.0.4+~7.0.11-2",
      "9.0.0+~8.0.1-1",
      "9.0.3+~8.0.1-1",
      "9.0.5+~8.0.1-1",
      "9.0.6+~8.0.1-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-100701.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  }
]

Publisher severity

No explicit severity was provided.

Event: #59440 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 18:30:21 GMT
Publisher date: Sat, 26 Sep 2026 14:16:55 GMT

Read the original announcement