CVE-2026-100701

Name	CVE-2026-100701
Description	Nodemailer versions 5.0.0 through 10.0.1 use a process-global DNS cache that is keyed only by the DNS host, while each cache entry also stores the caller-specific TLS servername. When two direct TLS/SMTPS transports (secure: true) resolve the same non-IP host with different tls.servername values, the first transport's servername is returned on the cache hit and overwrites the second transport's explicitly configured value, so Nodemailer sends the wrong SNI value and validates the peer certificate against the wrong identity. In multi-tenant services or SNI-routed SMTP gateways, an attacker who can prime the cache can cause a victim transport to connect to the attacker's TLS virtual host and accept the attacker's certificate even with rejectUnauthorized: true, disclosing the victim's SMTP credentials. Fixed in 10.0.2.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
node-nodemailer (PTS)	bookworm	6.8.0+~6.4.6-1	vulnerable
	trixie	6.10.0+~6.4.17-1+deb13u1	vulnerable
	forky, sid	10.0.14+~8.0.2-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
node-nodemailer	source	(unstable)	10.0.10+~8.0.1-1

Notes

[trixie] - node-nodemailer <no-dsa> (Minor issue)
[bookworm] - node-nodemailer <postponed> (Minor issue)
https://github.com/nodemailer/nodemailer/security/advisories/GHSA-6vj9-mwq6-2f5v
Fixed by: https://github.com/nodemailer/nodemailer/commit/a6512dbcb3c6e7f2f70d3acccc5752defe3c61fe (v10.0.2)