CVE-2026-100701: Nodemailer DNS Cache Info Disclosure

CVE-2026-100701 Overview

CVE-2026-100701 is a certificate validation vulnerability [CWE-295] in Nodemailer versions 5.0.0 through 10.0.1. The library uses a process-global Domain Name System (DNS) cache keyed only by hostname, while each cache entry stores the caller-specific Transport Layer Security (TLS) servername. When two direct TLS/SMTPS transports resolve the same host with different tls.servername values, the first transport's servername overwrites subsequent values. Nodemailer then sends an incorrect Server Name Indication (SNI) and validates the peer certificate against the wrong identity. The flaw is fixed in Nodemailer 10.0.2.

Critical Impact
An attacker who can prime the DNS cache in a multi-tenant service can redirect a victim transport to an attacker-controlled TLS virtual host and harvest Simple Mail Transfer Protocol (SMTP) credentials, even with rejectUnauthorized: true.

Affected Products

Nodemailer 5.0.0 through 10.0.1
Node.js applications using direct TLS/SMTPS transports with secure: true
Multi-tenant mail services and SNI-routed SMTP gateways relying on Nodemailer

Discovery Timeline

2026-09-26 - CVE-2026-100701 published to the National Vulnerability Database (NVD)
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-100701

Vulnerability Analysis

Nodemailer maintains a process-global DNS cache to avoid repeated name resolution for outbound SMTP connections. The cache key is the DNS host string, but each entry also stores the TLS servername supplied by the caller when the entry was created. On a cache hit, Nodemailer reuses the stored servername rather than the servername passed by the current transport. The result is a cross-transport collision inside a single process.

A direct TLS transport that explicitly sets tls.servername to its intended virtual host can still send a different SNI value if another transport previously resolved the same hostname with a different servername. Certificate validation then succeeds against the first transport's identity instead of the second transport's configured identity. The peer verification check becomes meaningless because the identity under test is attacker-influenced.

Root Cause

The root cause is a key/value mismatch in the DNS cache. The lookup key omits the TLS servername, but cached entries carry servername state that participates in the TLS handshake. Caller-specific security context is treated as if it were a shared property of the host, violating per-connection isolation.

Attack Vector

The attack requires an adversary who shares a Node.js process with the victim transport or who can otherwise prime the cache for a target hostname. In a Software-as-a-Service (SaaS) email relay or multi-tenant notification platform, the attacker configures a transport that resolves the same hostname with an attacker-controlled tls.servername. When the victim transport subsequently connects, Nodemailer sends the attacker's SNI, the SMTP gateway routes the Transmission Control Protocol (TCP) session to the attacker's virtual host, and the attacker's certificate validates successfully. The victim then transmits SMTP AUTH credentials over the attacker-trusted channel.

See the GitHub Security Advisory GHSA-6vj9-mwq6-2f5v and the VulnCheck Advisory for Nodemailer for additional technical context.

Detection Methods for CVE-2026-100701

Indicators of Compromise

Outbound SMTPS connections where the TLS SNI extension does not match the configured transport servername.
Successful TLS handshakes to SMTP endpoints presenting certificates issued for unexpected tenant identities.
SMTP AUTH exchanges to hosts outside the approved upstream relay inventory.
Nodemailer package versions between 5.0.0 and 10.0.1 recorded in package-lock.json or Software Bill of Materials (SBOM) output.

Detection Strategies

Inventory all Node.js services and parse lockfiles for nodemailer versions in the vulnerable range.
Instrument outbound TLS traffic to log the SNI value and the Subject Alternative Name (SAN) of the presented certificate, then alert on mismatches against expected transport configuration.
Review application logs for shared-process patterns where multiple tenants build Nodemailer transports targeting the same hostname with different tls.servername values.

Monitoring Recommendations

Forward SMTP egress telemetry and TLS handshake metadata to a centralized analytics pipeline for anomaly review.
Monitor dependency scanners and SBOM feeds for Nodemailer updates and flag any environment still pinned below 10.0.2.
Track SMTP authentication failures and credential-reset events that may indicate successful credential interception.

How to Mitigate CVE-2026-100701

Immediate Actions Required

Upgrade Nodemailer to version 10.0.2 or later across all services and container images.
Rotate SMTP credentials used by any multi-tenant Node.js process that ran a vulnerable Nodemailer release.
Audit transport configurations and confirm each tenant uses a dedicated process or verified per-connection servername handling.

Patch Information

The maintainers fixed the issue in Nodemailer 10.0.2 by scoping the DNS cache so that the TLS servername participates in cache identity. Update the dependency with npm install nodemailer@^10.0.2 or the equivalent command for yarn or pnpm, then rebuild and redeploy. Validate the upgrade by checking the resolved version in package-lock.json.

Workarounds

Disable the Nodemailer DNS cache for direct TLS transports until the upgrade is deployed.
Isolate tenants into separate Node.js processes so a cache collision cannot cross trust boundaries.
Pin outbound SMTP to a single trusted relay per process and remove tenant-controlled tls.servername configuration.

bash

# Configuration example
npm install nodemailer@^10.0.2
npm ls nodemailer