CVE-2026-100701
1 advisory.
npm/nodemailer CVE-2026-100701: medium 5.9
Nodemailer: Process-global DNS cache reuses TLS `servername` across transports, enabling cross-tenant SMTP credential disclosure
Action: Upgrade nodemailer to 10.0.2 or later.
npm i nodemailer@10.0.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 5.0.0 | 10.0.2 | - |
Fixed versions
| 10.0.2 |
Sources
- osv: GHSA-6vj9-mwq6-2f5v
- https://github.com/nodemailer/nodemailer/security/advisories/GHSA-6vj9-mwq6-2f5v
- https://github.com/nodemailer/nodemailer/commit/a6512dbcb3c6e7f2f70d3acccc5752defe3c61fe
- https://github.com/nodemailer/nodemailer
- https://github.com/nodemailer/nodemailer/releases/tag/v10.0.2
CVE-2026-100701 · published · modified · JSON