Nodemailer versions 5.0.0 through 10.0.1 use a process-global DNS cache keyed only by DNS host, but each cache entry stores the TLS servername specific to the caller. When two direct TLS/SMTPS transports resolve the same non-IP host with different tls.servername values, the first transport's servername is returned on cache hits, overwriting the second transport's configured value. This causes Nodemailer to send an incorrect SNI value and validate the peer certificate against the wrong identity. In multi-tenant or SNI-routed SMTP gateway environments, an attacker who can prime the DNS cache can cause a victim transport to connect to the attacker's TLS virtual host and accept the attacker's certificate even with rejectUnauthorized set to true, leading to disclosure of the victim's SMTP credentials. The vulnerability is fixed in version 10.0.2.

The vulnerability allows an attacker who can prime the DNS cache to cause a victim Nodemailer transport to connect to a malicious TLS host and accept a fraudulent certificate, bypassing TLS certificate validation. This can lead to disclosure of SMTP credentials, compromising email account security. The CVSS score is 5.9 (medium severity), reflecting network attack vector, high confidentiality impact, low integrity impact, and no availability impact.

Upgrade Nodemailer to version 10.0.2 or later, where this DNS cache and SNI handling issue is fixed. No other mitigations are indicated or required once the update is applied.