Ry2811

**Name of the Vulnerable Software and Affected Versions** Nodemailer versions 5.0.0 through 10.0.1 **Description** Nodemailer uses a process-global DNS cache keyed only by the DNS host, but stores the caller-specific TLS servername within each entry. When two direct TLS/SMTPS transports configured with `secure: true` resolve the same non-IP host using different `tls.servername` values, the first transport's servername is returned during a cache hit. This overwrites the second transport's configured value, causing Nodemailer to send an incorrect Server Name Indication (SNI) value and validate the peer certificate against the wrong identity. In multi-tenant services or SNI-routed SMTP gateways, an attacker capable of priming the cache can force a victim transport to connect to the attacker's TLS virtual host and accept the attacker's certificate, even when `rejectUnauthorized: true` is set, potentially disclosing the victim's SMTP credentials. **Recommendations** Update Nodemailer to version 10.0.2.

**Name of the Vulnerable Software and Affected Versions** Nodemailer versions prior to 10.0.2 **Description** Improper flattening of deeply nested arrays in recipient fields such as `to`, `cc`, and `bcc` can lead to stack exhaustion. An attacker can provide a deeply nested JSON recipient array that triggers a recursive `Array.toString()` conversion, which exhausts the call stack and terminates the Node.js process. **Recommendations** Update to version 10.0.2 or later.