CVE-2026-100701
Received Received - Intake

SNI Spoofing in Nodemailer via DNS Cache Poisoning

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Nodemailer versions 5.0.0 through 10.0.1 use a process-global DNS cache that is keyed only by the DNS host, while each cache entry also stores the caller-specific TLS servername. When two direct TLS/SMTPS transports (secure: true) resolve the same non-IP host with different tls.servername values, the first transport's servername is returned on the cache hit and overwrites the second transport's explicitly configured value, so Nodemailer sends the wrong SNI value and validates the peer certificate against the wrong identity. In multi-tenant services or SNI-routed SMTP gateways, an attacker who can prime the cache can cause a victim transport to connect to the attacker's TLS virtual host and accept the attacker's certificate even with rejectUnauthorized: true, disclosing the victim's SMTP credentials. Fixed in 10.0.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100701
EUVD
EUVD-2026-87674

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
nodemailer nodemailer 10.0.2
nodemailer nodemailer From 5.0.0 (inc) to 10.0.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Nodemailer versions 5.0.0 through 10.0.1 have a process-global DNS cache that uses only the DNS host as a key but stores caller-specific TLS servernames. When two transports use the same non-IP host with different TLS servername values, the first transport's servername overwrites the second's, causing Nodemailer to send the wrong SNI value and validate the peer certificate against the wrong identity. This allows attackers to trick victims into connecting to malicious endpoints and expose SMTP credentials.

Detection Guidance

To detect this vulnerability, check if your system is running Nodemailer versions 5.0.0 through 10.0.1. Use commands like 'npm list nodemailer' or 'npm ls nodemailer' to verify the installed version. If the version falls within this range, the system is vulnerable.

Impact Analysis

An attacker can prime the DNS cache to force a victim's Nodemailer transport to connect to the attacker's server instead of the intended one. Even with rejectUnauthorized set to true, the victim's SMTP credentials may be sent to the attacker's endpoint during the cache lifetime, leading to credential theft. This primarily affects multi-tenant services or SNI-routed SMTP gateways using long-running applications.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, such as SMTP credentials, potentially violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Unauthorized credential exposure may result in compliance breaches, unauthorized data access, or data breaches, depending on the context of use.

Mitigation Strategies

Upgrade Nodemailer to version 10.0.2 or later immediately. This version fixes the DNS cache issue by removing the servername from the cache key. Run 'npm update nodemailer' or specify the fixed version in your package.json.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100701. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart