146 matches found
GHSA-6VJ9-MWQ6-2F5V Nodemailer: Process-global DNS cache reuses TLS `servername` across transports, enabling cross-tenant SMTP credential disclosure
Summary Nodemailer's process-global DNS cache is keyed only by host, but each cache entry also stores the caller-specific TLS servername. When two direct SMTPS transports use the same DNS host with different tls.servername values, the first transport's server name is returned to the second...
5.9CVSS6AI score0.00114EPSS
SaveExploits0References4
20