CVE-2026-100701: Nodemailer Cross-Tenant SMTP Credential Disclosure via DNS Cache Confusion
Summary
CVE-2026-100701: Nodemailer's process-global DNS cache is keyed only by host, but each cache entry also stores the caller-specific TLS servername. Affects nodemailer versions >= 5.0.0, < 10.0.2. Fixed in 10.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Nodemailer is a popular Node.js module used for sending emails. It provides a simple API to integrate email sending capabilities into applications. Nodemailer supports various transport methods, including SMTP, and is widely used in web applications for transactional emails. However, it has a vulnerability that affects its DNS caching mechanism, which can lead to security issues in multi-tenant environments.
Vulnerability Detail
The vulnerability arises from Nodemailer's process-global DNS cache, which is keyed only by the host. This cache implementation allows different transports to share the same DNS host but use different TLS server names. When one transport sets a server name, it can overwrite the server name of another transport that connects later. This leads to a situation where a victim's SMTP credentials can be sent to an attacker's server, as the wrong SNI value is used during the TLS handshake. The vulnerability is particularly dangerous in multi-tenant services where different users share the same SMTP gateway.
How To Fix
Latest published version: 10.2.1 as of 22 Oct 2026
npm install nodemailer@10.2.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
10.0.2
This is the first release that contains the fix.
npm install nodemailer@10.0.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the same non-IP host for different transports with varying TLS server names. This can prevent the cache confusion issue. If you must use the same host, ensure that different transports are not created within the same process or consider using IP addresses instead of DNS names.
Conclusion
The CVE-2026-100701 vulnerability in Nodemailer poses a significant risk in multi-tenant environments by allowing cross-tenant SMTP credential disclosure. It is crucial for developers using Nodemailer to understand this vulnerability, implement the suggested workarounds, and monitor for future patches to ensure the security of their applications.
See every vulnerability recorded for nodemailer →
FAQ
CVE-2026-100701 is a vulnerability in Nodemailer that allows cross-tenant SMTP credential disclosure due to a flaw in the DNS caching mechanism.
If your application uses Nodemailer with shared DNS hosts for different transports, an attacker could potentially intercept SMTP credentials from other users.
The CVSS score for this vulnerability is 5.9, indicating a moderate level of risk.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
As of now, there is no patched version available. Keep an eye on the Nodemailer repository for updates.
References
Related vulnerabilities
Recent vulnerabilities recorded for nodemailer.
