Detections
Analytics

SCA: security update for nodemailer (GHSA-6vj9-mwq6-2f5v)

high Tenable Self-Hosted Container Security Plugin ID 448454

Description

Nodemailer: Process-global DNS cache reuses TLS `servername` across transports, enabling cross-tenant SMTP credential disclosure

Solution

Update the nodemailer library and its related packages to version 10.0.2 or later.

See Also

https://github.com/advisories/GHSA-6vj9-mwq6-2f5v

Plugin Details

Severity: High

ID: 448454

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 9/29/2026

Updated: 9/29/2026

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/28/2026

Vulnerability Publication Date: 9/28/2026

Reference Information

cwe: CWE-295