CVE-2026-100701
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
Nodemailer versions 5.0.0 through 10.0.1 use a process-global DNS cache that is keyed only by the DNS host, while each cache entry also stores the caller-specific TLS servername. When two direct TLS/SMTPS transports (secure: true) resolve the same non-IP host with different tls.servername values, the first transport's servername is returned on the cache hit and overwrites the second transport's explicitly configured value, so Nodemailer sends the wrong SNI value and validates the peer certificate against the wrong identity. In multi-tenant services or SNI-routed SMTP gateways, an attacker who can prime the cache can cause a victim transport to connect to the attacker's TLS virtual host and accept the attacker's certificate even with rejectUnauthorized: true, disclosing the victim's SMTP credentials. Fixed in 10.0.2.
Risk Assessment
Risk includes the possibility of an attacker intercepting the victim's SMTP credentials by manipulating the DNS cache, which can lead to unauthorized email sending and confidentiality breach.
Recommendation
Update Nodemailer to version 10.0.2 or later, which fixes the vulnerability.
Other vulnerabilities in Nodemailer
See all- GHSA-wmmp-3585-3rmpMedium
Nodemailer resolves an international (IDN / non-ASCII) recipient domain to a different Punycode label than every UTS-46-conformant parser (web browsers, WHATWG URL Standard, Node's url.domainToASCII, Python's idna). Its address normalizer (_normalizeAddress) may lead to incorrect domain resolution, enabling phishing or message misdirection.
- GHSA-2x7j-588g-ccc2High
Nodemailer's address parser parses comma-separated addresses in quadratic time (O(n²)) in the number of addresses. A single crafted address string (e.g., To, Cc, Bcc, From, Reply-To) can cause significant slowdown.
- GHSA-cc9r-2j5m-2m83Medium
Nodemailer's email-address parser treats an RFC 5322 comment inside the domain as a point to concatenate the surrounding text, rather than as folding whitespace (CFWS) that terminates the domain. This can lead to incorrect parsing, e.g., [email protected](x)evil.c..., potentially redirecting messages or bypassing validation.
- GHSA-8m3c-c648-2xjjMedium
Nodemailer's disableFileAccess/disableUrlAccess options are a security sandbox that forbids untrusted message content from reading local files or making outbound HTTP(S) requests. The fix for GHSA-wqvq-jvpq-h66f may be incomplete, allowing bypass of the sandbox.
- GHSA-r7g4-qg5f-qqm2Medium
Nodemailer disables TLS certificate verification in its internal HTTPS fetch client by setting rejectUnauthorized: false in lib/fetch/index.js. This causes OAuth2 token requests to trust invalid or self-signed HTTPS certificates.
- GHSA-8vvx-rff5-p5rqMedium
A vulnerability exists in the nodemailer package (npm) affecting versions from 2.7.2 to 10.0.1. Details are not fully described in the provided snippet, but vulnerable versions are confirmed.
- GHSA-268h-hp4c-crq3Medium
A vulnerability in the Nodemailer library allows header injection via the `list.*.comment` field, which is not sanitized for CR (`\r`) and LF (`\n`) characters. An attacker can supply a malicious value in this field, leading to email header spoofing.
- GHSA-p6gq-j5cr-w38fHigh
In nodemailer v9.0.0, the message-level `raw` option bypasses `disableFileAccess` and `disableUrlAccess` protections, enabling arbitrary file reads and full SSRF (Server-Side Request Forgery) in the sent message.
- GHSA-wqvq-jvpq-h66fMedium
A vulnerability in Nodemailer allows bypassing the `disableFileAccess` and `disableUrlAccess` options when using `jsonTransport`. While the normal MIME streaming path enforces these restrictions, `jsonTransport` serializes the message in a way that bypasses them, potentially enabling access to local files or external URLs.
- GHSA-6vj9-mwq6-2f5vMedium
Nodemailer's process-global DNS cache is keyed only by `host`, but each cache entry also stores the caller-specific TLS `servername`. When two direct SMTPS transports use the same DNS host with different `tls.servername` values, the first transport's server name is returned to the second.
Original NVD description (English source)
Nodemailer versions 5.0.0 through 10.0.1 use a process-global DNS cache that is keyed only by the DNS host, while each cache entry also stores the caller-specific TLS servername. When two direct TLS/SMTPS transports (secure: true) resolve the same non-IP host with different tls.servername values, the first transport's servername is returned on the cache hit and overwrites the second transport's explicitly configured value, so Nodemailer sends the wrong SNI value and validates the peer certificate against the wrong identity. In multi-tenant services or SNI-routed SMTP gateways, an attacker who can prime the cache can cause a victim transport to connect to the attacker's TLS virtual host and accept the attacker's certificate even with rejectUnauthorized: true, disclosing the victim's SMTP credentials. Fixed in 10.0.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS