https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 21:08:47 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-100701 <p>Nodemailer versions 5.0.0 through 10.0.1 use a process-global DNS cache that is keyed only by the DNS host, while each cache entry also stores the caller-specific TLS servername. When two direct TLS/SMTPS transports (secure: true) resolve the same non-IP host with different tls.servername values, the first transport&#39;s servername is returned on the cache hit and overwrites the second transport&#39;s explicitly configured value, so Nodemailer sends the wrong SNI value and validates the peer certificate against the wrong identity. In multi-tenant services or SNI-routed SMTP gateways, an attacker who can prime the cache can cause a victim transport to connect to the attacker&#39;s TLS virtual host and accept the attacker&#39;s certificate even with rejectUnauthorized: true, disclosing the victim&#39;s SMTP credentials. Fixed in 10.0.2.</p> <p>Nodemailer versions 5.0.0 through 10.0.1 use a process-global DNS cache that is keyed only by the DNS host, while each cache entry also stores the caller-specific TLS servername. When two direct TLS/SMTPS transports (secure: true) resolve the same non-IP host with different tls.servername values, the first transport&#39;s servername is returned on the cache hit and overwrites the second transport&#39;s explicitly configured value, so Nodemailer sends the wrong SNI value and validates the peer certificate against the wrong identity. In multi-tenant services or SNI-routed SMTP gateways, an attacker who can prime the cache can cause a victim transport to connect to the attacker&#39;s TLS virtual host and accept the attacker&#39;s certificate even with rejectUnauthorized: true, disclosing the victim&#39;s SMTP credentials. Fixed in 10.0.2.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-100701 https://vulnerability.circl.lu/vuln/ghsa-2mg4-38wg-2h6f <p>Nodemailer versions 5.0.0 through 10.0.1 use a process-global DNS cache that is keyed only by the DNS host, while each cache entry also stores the caller-specific TLS servername. When two direct TLS/SMTPS transports (secure: true) resolve the same non-IP host with different tls.servername values, the first transport&#39;s servername is returned on the cache hit and overwrites the second transport&#39;s explicitly configured value, so Nodemailer sends the wrong SNI value and validates the peer certificate against the wrong identity. In multi-tenant services or SNI-routed SMTP gateways, an attacker who can prime the cache can cause a victim transport to connect to the attacker&#39;s TLS virtual host and accept the attacker&#39;s certificate even with rejectUnauthorized: true, disclosing the victim&#39;s SMTP credentials. Fixed in 10.0.2.</p> <p>Nodemailer versions 5.0.0 through 10.0.1 use a process-global DNS cache that is keyed only by the DNS host, while each cache entry also stores the caller-specific TLS servername. When two direct TLS/SMTPS transports (secure: true) resolve the same non-IP host with different tls.servername values, the first transport&#39;s servername is returned on the cache hit and overwrites the second transport&#39;s explicitly configured value, so Nodemailer sends the wrong SNI value and validates the peer certificate against the wrong identity. In multi-tenant services or SNI-routed SMTP gateways, an attacker who can prime the cache can cause a victim transport to connect to the attacker&#39;s TLS virtual host and accept the attacker&#39;s certificate even with rejectUnauthorized: true, disclosing the victim&#39;s SMTP credentials. Fixed in 10.0.2.</p> https://vulnerability.circl.lu/vuln/ghsa-2mg4-38wg-2h6f