Nodemailer 5.0.0 through 10.0.1 TLS servername Cache Confusion

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-100701 · CVE overview and exploitation status

EUVD-2026-87674

GHSA-2mg4-38wg-2h6f

GHSA-6vj9-mwq6-2f5v

cve-program · CVE-2026-100701

• https://github.com/nodemailer/nodemailer/security/advisories/GHSA-6vj9-mwq6-2f5v
• https://www.vulncheck.com/advisories/nodemailer-5.0.0-through-10.0.1-tls-servername-cache-confusion

euvd · EUVD-2026-87674

• https://github.com/nodemailer/nodemailer/security/advisories/GHSA-6vj9-mwq6-2f5v
• https://www.vulncheck.com/advisories/nodemailer-5.0.0-through-10.0.1-tls-servername-cache-confusion

nvd · CVE-2026-100701

• https://github.com/nodemailer/nodemailer/security/advisories/GHSA-6vj9-mwq6-2f5v
• https://www.vulncheck.com/advisories/nodemailer-5.0.0-through-10.0.1-tls-servername-cache-confusion

osv · GHSA-6vj9-mwq6-2f5v

• https://github.com/nodemailer/nodemailer/security/advisories/GHSA-6vj9-mwq6-2f5v
• https://github.com/nodemailer/nodemailer/commit/a6512dbcb3c6e7f2f70d3acccc5752defe3c61fe
• https://github.com/nodemailer/nodemailer
• https://github.com/nodemailer/nodemailer/releases/tag/v10.0.2

• Nodemailer versions 5.0.0 through 10.0.1 use a process-global DNS cache that is keyed only by the DNS host, while each cache entry also stores the caller-specific TLS servername. When two direct TLS/SMTPS transports (secure: true) resolve t… · Advisory content revised · 11 Nov 2026