{"uuid": "6ceef21a-2666-423b-a4fd-ad494fc5b2ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-6VJ9-MWQ6-2F5V", "type": "seen", "source": "https://gist.github.com/alon710/46e9743502d17fce99356c3746275ed5", "content": "# GHSA-6VJ9-MWQ6-2F5V: GHSA-6VJ9-MWQ6-2F5V: Cross-Tenant SMTP Credential Disclosure via Shared-State DNS Cache Pollution in Nodemailer\n\n> **CVSS Score:** 5.9\n> **Published:** 2026-09-28\n> **Full Report:** https://cvereports.com/reports/GHSA-6VJ9-MWQ6-2F5V\n\n## Summary\nNodemailer versions 5.0.0 up to 10.0.1 are vulnerable to process-global state contamination inside the DNS caching subsystem. When SMTPS connections are established in a multi-tenant Node.js process targeting a shared gateway, a lower-privilege attacker can seed the global DNS cache with a malicious TLS servername. When a victim subsequently resolves the same gateway host, Nodemailer retrieves the polluted servername, overwrites the victim's connection settings, redirects the TLS session to the attacker's virtual host, and transmits the victim's cleartext SMTP credentials directly to the attacker.\n\n## TL;DR\nA shared-state vulnerability in Nodemailer's global DNS cache allows attackers to poison connection-specific TLS metadata. This redirects victim SMTPS sessions to an attacker-controlled virtual host, disclosing plaintext SMTP credentials.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-295\n- **Attack Vector**: Network\n- **CVSS**: 5.9 (Medium)\n- **Impact**: High (Cleartext Credential Disclosure)\n- **Exploit Status**: PoC Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Node.js applications running multi-tenant Nodemailer instances.\n- SaaS platforms employing shared SMTP relay gateways.\n- **nodemailer**: >= 5.0.0, < 10.0.2 (Fixed in: `10.0.2`)\n\n## Mitigation\n\n- Upgrade Nodemailer dependencies to a secure version (v10.0.2 or later).\n- Bypass DNS caching entirely by specifying IP addresses as the transport host parameter.\n- Isolate tenant execution environments to separate Node.js runtime processes.\n\n**Remediation Steps:**\n1. Open your application's package configuration file (package.json).\n2. Update the 'nodemailer' dependency specification to '^10.0.2'.\n3. Execute an npm install or yarn install to update the dependency tree.\n4. Verify that SMTPS connections establish properly and inspect outbound SNI logs.\n\n## References\n\n- [GitHub Security Advisory GHSA-6VJ9-MWQ6-2F5V](https://github.com/advisories/GHSA-6VJ9-MWQ6-2F5V)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-6VJ9-MWQ6-2F5V) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-28T22:30:31.000000Z"}