Nodemailer CVE-2026-100701

Requires all of: two or more direct TLS/SMTPS transports configured with secure:true resolving the SAME non-IP hostname but with DIFFERENT tls.servername values, running in the SAME Node.js process so they share the process-global DNS cache; and an attacker positioned to prime that cache first (typically a co-tenant in a multi-tenant service or an SNI-routed SMTP gateway). Limiting factors: exploitation is a timing/ordering race (AC:H, AT:P) requiring the attacker's resolution to win the cache, low-privilege foothold on the shared service (PR:L), and the deployment must actually multiplex distinct servernames over one shared cache - single-tenant or IP-host or per-process-isolated deployments are not affected. Notably, rejectUnauthorized:true does NOT mitigate this because the wrong-but-valid certificate is accepted.

This is a genuine but conditional confidentiality issue, not a broad emergency. The vendor CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:N/VC:H) correctly signals the tension: network-reachable but with HIGH attack complexity and a Present attack requirement (AT:P), plus low privileges required. That combination - cache-priming race against a shared process-global DNS cache in a multi-tenant deployment - is why the score lands at 6.0 (MEDIUM) despite a HIGH confidentiality impact (SMTP credential disclosure). No EPSS score, no CISA KEV listing, and no public exploit are present in the input, so exploitation status is 'no public exploit identified at time of analysis.' The realistic risk is targeted and situational rather than opportunistic mass exploitation: an attacker must be a co-resident tenant or otherwise able to influence the shared cache on an SNI-routed SMTP gateway. There is no version/vector conflict to flag - the CVSS 4.0 vector, the EUVD affected range (5.0.0 <10.0.2), and the description are mutually consistent. The tag 'Authentication Bypass' is a loose fit; the underlying weakness is CWE-295 improper certificate validation (TLS servername/SNI confusion) leading to credential disclosure, which is better characterized as a cert-validation/MITM issue than an auth bypass.

In a multi-tenant Node.js service that shares one Nodemailer process across tenants, an attacker-controlled transport first resolves a target SMTP host to seed the process-global DNS cache with the attacker's tls.servername. When a victim tenant's direct TLS/SMTPS transport then resolves the same host, it receives the poisoned cache entry, sends the wrong SNI, and validates the attacker's TLS virtual host certificate as valid - even with rejectUnauthorized: true - causing the victim to connect to the attacker and leak its SMTP credentials. No public exploit is identified at time of analysis.