{"action":"Upgrade nodemailer to 10.0.2 or later.","affected":[{"fixed":"10.0.2","introduced":"5.0.0"}],"component":"nodemailer","cve_ids":["CVE-2026-100701"],"ecosystem":"npm","epss":0.00114,"exploited":false,"fixed_versions":["10.0.2"],"ghsa_id":"GHSA-6vj9-mwq6-2f5v","id":"tcs_01M5KF81QAQNZYAD1X73RX0N5V","modified_at":"2026-09-28T22:00:08.256596460Z","published_at":"2026-09-28T21:56:05Z","references":["https://osv.dev/vulnerability/GHSA-6vj9-mwq6-2f5v","https://github.com/nodemailer/nodemailer/security/advisories/GHSA-6vj9-mwq6-2f5v","https://github.com/nodemailer/nodemailer/commit/a6512dbcb3c6e7f2f70d3acccc5752defe3c61fe","https://github.com/nodemailer/nodemailer","https://github.com/nodemailer/nodemailer/releases/tag/v10.0.2"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-6vj9-mwq6-2f5v","url":"https://osv.dev/vulnerability/GHSA-6vj9-mwq6-2f5v"}],"summary":"Nodemailer: Process-global DNS cache reuses TLS `servername` across transports, enabling cross-tenant SMTP credential disclosure"}