Nodemailer versions from 5.0.0 up to 10.0.1 have a vulnerability in their process-global DNS cache that causes TLS server name indication (SNI) to be reused incorrectly across SMTP transports. This flaw allows one tenant in a multi-tenant environment to cause another tenant's SMTP transport to use the attacker's TLS server name and certificate, leading to potential SMTP credential disclosure. The issue arises because the DNS cache key is only the host, but the cached value includes the TLS server name, which is overwritten and reused improperly. No official patch was available at the time of this report.