TLS Cache Confusion Vulnerability in Nodemailer by Nodemailer
CVE-2026-100701

6MEDIUM

Key Information:

Vendor

Nodemailer

Status
Nodemailer
Vendor
CVE Published:
26 September 2026

What is CVE-2026-100701?

Nodemailer versions 5.0.0 through 10.0.1 contain a vulnerability related to the process-global DNS cache, which can lead to incorrect handling of TLS connections. This issue arises when multiple TLS/SMTPS transports resolve the same non-IP hostname but with differing tls.servername values. As the first transport’s servername overwrites the subsequent transport’s explicitly configured value, Nodemailer sends an incorrect Server Name Indication (SNI) value. An attacker exploiting this flaw can manipulate the cache, causing a victim transport to connect to an adversary's TLS server, potentially exposing sensitive SMTP credentials even if the rejectUnauthorized option is enabled. This vulnerability has been addressed in version 10.0.2.

Affected Version(s)

nodemailer 5.0.0 < 10.0.2

nodemailer 10.0.2

References

https://github.com/nodemailer/nodemailer/security/advisor...
vendor-advisory
https://www.vulncheck.com/advisories/nodemailer-5.0.0-thr...
third-party-advisory

CVSS V4

Score:
6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ry2811
.