CVE-2026-100701

Executive Summary

CVE-2026-100701 is an improper certificate validation vulnerability in Nodemailer versions 5.0.0 through 10.0.1. The library uses a process-global DNS cache keyed only by DNS host, while cache entries also store caller-specific TLS servername values. When two direct TLS/SMTPS transports resolve the same non-IP host with different tls.servername values, the first transport's servername is returned on cache hits, causing Nodemailer to send the wrong SNI value and validate the peer certificate against the wrong identity. This enables an attacker who can prime the cache to redirect a victim transport to their TLS virtual host and accept their certificate even with rejectUnauthorized: true, disclosing SMTP credentials in multi-tenant or SNI-routed environments.

Technical Analysis

The vulnerability resides in Nodemailer's DNS caching implementation, specifically affecting direct TLS/SMTPS transports configured with secure: true. The core issue is a cache key mismatch: the process-global DNS cache uses only the DNS host as its key, but each cache entry stores additional caller-specific TLS configuration—namely the tls.servername value. This design flaw means that when two separate transports resolve the same non-IP hostname, the first transport's tls.servername is cached and subsequently returned to the second transport on a cache hit. As a result, the second transport overwrites its own explicitly configured tls.servername with the cached value from the first transport.

This leads to two critical failures: Nodemailer sends the wrong SNI (Server Name Indication) value during the TLS handshake, and it validates the peer certificate against the wrong identity. In environments where multiple tenants or SNI-routed SMTP gateways are used, this becomes an attack vector. An attacker who can prime the cache—by triggering a DNS resolution for a shared hostname with a malicious tls.servername—can cause a victim transport to connect to the attacker's TLS virtual host. Because the certificate validation is performed against the wrong identity, the attacker's certificate is accepted even when rejectUnauthorized: true is set. This allows the attacker to intercept and disclose the victim's SMTP credentials.

The vulnerability class is improper certificate validation (CWE-295), and the attack mechanism relies on cache poisoning within the application process. The CVSS vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N indicates a network-accessible attack requiring high complexity and low privileges, with high confidentiality impact, low integrity impact, and no availability impact. The complexity is high because the attacker must be able to influence the DNS cache state, which typically requires either a multi-tenant environment where the attacker controls one tenant's transport configuration or the ability to inject a malicious transport into the process.

Exploitation Scenarios

1. Reconnaissance/target identification: The attacker identifies a multi-tenant service or SNI-routed SMTP gateway that uses Nodemailer versions 5.0.0 through 10.0.1 with secure: true direct TLS/SMTPS transports. The attacker looks for scenarios where multiple transports resolve the same non-IP hostname but use different tls.servername values. This could be a shared SMTP gateway where different tenants configure different SNI values, or a service that dynamically creates transports based on user input.

2. Triggering the flaw: The attacker primes the DNS cache by causing a transport under their control to resolve the target hostname with a malicious tls.servername. This could be achieved by sending an email through the application that triggers a new transport creation, or by exploiting an API that allows configuring SMTP settings. The cache entry is created with the attacker's tls.servername.

3. Payload/execution method: When the victim's transport later resolves the same hostname, it receives the cached entry containing the attacker's tls.servername. Nodemailer then sends this wrong SNI value during the TLS handshake and validates the peer certificate against the attacker's identity. The attacker's TLS virtual host, presenting a certificate for the attacker's domain, is accepted because the validation is performed against the wrong servername. The victim's transport then proceeds to send SMTP credentials to the attacker's server.

4. Post-exploitation impact: The attacker captures the victim's SMTP credentials, which can be used to send unauthorized emails, access sensitive information, or pivot to other systems. In multi-tenant environments, this could lead to cross-tenant credential theft and further compromise. The attacker may also use the credentials to conduct phishing campaigns or exfiltrate data.

No public PoC is available; the attack chain is inferred from the vulnerability class and the NVD description.

Impact Assessment

The business impact is significant for organizations using Nodemailer in multi-tenant or SNI-routed SMTP configurations. The confidentiality impact is high (C:H) as SMTP credentials can be disclosed, leading to unauthorized access to email systems and potential data breaches. The integrity impact is low (I:L) because the attacker can manipulate the TLS connection but not necessarily modify email content without further access. Availability is not impacted (A:N). The blast radius includes any application or service that uses affected Nodemailer versions with direct TLS/SMTPS transports in shared environments. This could affect cloud-based email services, marketing automation platforms, and any SaaS application that sends emails on behalf of multiple tenants. The CVSS score of 5.9 reflects the high complexity and low privileges required, but the potential for credential theft makes it a serious concern for affected deployments.

Detection Guidance

Sigma Rule

title: Nodemailer TLS Servername Cache Poisoning
id: 8f3a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects potential cache poisoning attempts targeting Nodemailer's DNS cache leading to wrong SNI and certificate validation.
author: Threat Intelligence
date: 2026-01-15
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: '/node'
    CommandLine|contains: 'nodemailer'
    CommandLine|contains: 'secure: true'
  condition: selection
falsepositives:
  - Legitimate use of Nodemailer with secure transports
level: medium
tags:
  - attack.t1557
  - cve.2026.100701

YARA Rule

rule CVE_2026_100701_Nodemailer_Cache_Poisoning
{
    meta:
        description = "Detects Nodemailer versions vulnerable to DNS cache poisoning leading to wrong SNI"
        author = "Threat Intelligence"
        date = "2026-01-15"
        reference = "CVE-2026-100701"
        severity = "medium"
    strings:
        $s1 = "nodemailer" nocase
        $s2 = "tls.servername" nocase
        $s3 = "secure: true" nocase
        $s4 = "rejectUnauthorized" nocase
        $s5 = "dnsCache" nocase
    condition:
        uint16(0) == 0x4D5A or uint32(0) == 0x464C457F or true
        and 2 of ($s1, $s2, $s3, $s4, $s5)
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 465 (msg:"CVE-2026-100701 Nodemailer TLS SNI Mismatch Attempt"; flow:to_server,established; content:"|16 03|"; depth:2; content:"|01|"; within:1; content:"|00 00|"; distance:0; within:2; pcre:"/tls\.servername/i"; threshold:type limit, track by_src, count 1, seconds 60; classtype:attempted-recon; sid:1000001; rev:1;)

Elastic Detection

process where process.name == "node" and process.args : "*nodemailer*" and process.args : "*secure: true*"

Splunk SPL Query

index=main sourcetype=nodejs_logs
| search "nodemailer" AND "tls.servername" AND "secure: true"
| stats count by host, user, process
| where count > 0

Wazuh OSSEC Rule

<group name="nodemailer,">
  <rule id="100701" level="10">
    <decoded_as>json</decoded_as>
    <field name="message">nodemailer.*tls\.servername.*secure: true</field>
    <description>CVE-2026-100701: Nodemailer TLS servername cache poisoning attempt detected</description>
    <mitre>
      <id>T1557</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Isolate Nodemailer transports per tenant or per process to prevent cross-contamination of the DNS cache.
   • Avoid using the same non-IP hostname with different tls.servername values in the same process.
   • Implement network segmentation and TLS inspection to detect anomalous SNI values.
   • Monitor for unexpected certificate validation successes from unknown virtual hosts.

2. Patch/upgrade steps:

   • Upgrade to Nodemailer 10.0.2 or later, which contains the fix.
   • If upgrade is not immediately possible, apply the workaround of manually specifying the IP address instead of hostname to bypass DNS cache, or disable DNS caching if configurable.
   • Verify the patch by checking the Nodemailer changelog for the version that addresses CVE-2026-100701.

3. Long-term hardening:

   • Implement per-transport DNS caching or ensure cache keys include TLS servername.
   • Enforce strict certificate validation with rejectUnauthorized: true and pinning where possible.
   • Conduct regular dependency audits and subscribe to security advisories for Nodemailer.
   • Use infrastructure-as-code to enforce version pinning and rapid patching.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100701
• Nodemailer GitHub: https://github.com/nodemailer/nodemailer
• Nodemailer Security Advisories: https://github.com/nodemailer/nodemailer/security/advisories
• CWE-295: https://cwe.mitre.org/data/definitions/295.html
• CISA KEV: Not applicable (CVE not listed)