CVE-2026-100701 in Nodemailer
Summary
by MITRE • 09/26/2026
Nodemailer versions 5.0.0 through 10.0.1 use a process-global DNS cache that is keyed only by the DNS host, while each cache entry also stores the caller-specific TLS servername. When two direct TLS/SMTPS transports (secure: true) resolve the same non-IP host with different tls.servername values, the first transport's servername is returned on the cache hit and overwrites the second transport's explicitly configured value, so Nodemailer sends the wrong SNI value and validates the peer certificate against the wrong identity. In multi-tenant services or SNI-routed SMTP gateways, an attacker who can prime the cache can cause a victim transport to connect to the attacker's TLS virtual host and accept the attacker's certificate even with rejectUnauthorized: true, disclosing the victim's SMTP credentials. Fixed in 10.0.2.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified in Nodemailer versions 5.0.0 through 10.0.1 stems from a flawed implementation of process-global DNS caching that fails to account for distinct TLS server name indications, leading to potential identity confusion and credential theft. In standard Node.js environments, the underlying DNS resolver maintains a global cache keyed solely by the hostname string to optimize repeated lookups for identical domains. However, Nodemailer extends this mechanism by storing caller-specific configuration details, specifically the tls.servername value required for Server Name Indication during TLS handshakes, within these cached entries. The critical architectural flaw lies in the fact that while the cache key is based only on the DNS host, the stored metadata includes a single server name instance. This design assumes that all connections to a given hostname will utilize the same SNI value, which is not true in environments where multiple virtual hosts share an IP address or when different applications connect to the same mail relay with distinct certificate requirements.
When two direct TLS or SMTPS transports attempt to resolve the same non-IP host but specify different tls.servername values, a race condition and state corruption occur within the global cache. The first transport to complete its DNS resolution populates the cache entry with its specific server name. Subsequently, when the second transport performs a lookup for the identical hostname, it receives a cache hit that returns the previously stored server name from the first transport rather than resolving or retaining its own explicitly configured value. Consequently, Nodemailer initiates an SMTPS connection using the wrong SNI value. This mismatch causes the TLS handshake to present an incorrect identity to the remote mail server and forces the client to validate the peer certificate against a hostname that does not match the actual server name intended by the application configuration.
The operational impact of this flaw is severe in multi-tenant services or environments utilizing Server Name Indication routed SMTP gateways, where multiple customers share infrastructure but maintain separate credentials and security contexts. An attacker who can control one transport's connection parameters to a shared hostname can prime the DNS cache with their desired malicious server name. When a victim process subsequently attempts to connect to that same hostname for legitimate mail delivery, it will inadvertently use the attacker-controlled SNI value due to the cached entry overwrite. If the environment relies on TLS certificate validation via rejectUnauthorized set to true, this vulnerability allows an attacker to intercept traffic by presenting their own valid or self-signed certificate under a domain name that matches the primed cache entry but not the victim's intended target. This effectively bypasses standard certificate verification mechanisms because the client validates against the wrong identity, leading to the disclosure of sensitive SMTP credentials and email content to the malicious actor.
Mitigation strategies must prioritize immediate software updates alongside architectural adjustments for high-security environments. The primary remediation is upgrading Nodemailer to version 10.0.2 or later, where this caching logic has been corrected to ensure that cache keys incorporate sufficient context to distinguish between different TLS configurations for the same hostname. For organizations unable to upgrade immediately due to dependency constraints, implementing a workaround involves ensuring that each distinct logical tenant or security boundary uses isolated Node.js processes rather than sharing a single process global state. This isolation prevents one transport's DNS resolution from polluting the cache entries accessible by another transport within the same runtime environment. Additionally, developers should review their use of shared SMTP connections and consider using separate connection pools for different tenants to minimize cross-contamination risks even if underlying library vulnerabilities persist in older versions.
From a classification perspective, this vulnerability aligns with CWE-200: Information Exposure, as it leads to the disclosure of sensitive authentication credentials through improper validation logic. It also relates closely to CWE-697: Incorrect Comparison, specifically regarding the failure to correctly compare or isolate context-specific parameters during cache retrieval operations. In terms of offensive security frameworks such as MITRE ATT&CK, this flaw facilitates techniques associated with Credential Access and potentially Man-in-the-Middle attacks by allowing an attacker to manipulate TLS handshake parameters to impersonate legitimate services. The exploitation vector typically requires the ability to influence DNS resolution outcomes or control initial connection attempts within a shared process space, highlighting the importance of strict isolation boundaries in multi-tenant SaaS applications that rely on Node.js-based mail delivery systems.