AIKIDO-2026-52490

TL;DR

Nodemailer keeps a process-global DNS cache in src/shared/index.ts that is keyed by hostname alone but also stores each connection's TLS server name. When multiple direct SMTPS transports in one process resolve the same host with different tls.servername values, the cache returns the first resolver's server name to later connections. Those connections then present and verify that stale SNI, so certificate validation runs against the wrong identity and credentials can be sent to an unintended endpoint. The fix stops caching the server name and derives it per connection from options.servername.