CVE-2026-82662: Nodemailer before 8.0.8 TLS Certificate Validation Bypass
Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitted over compromised HTTPS connections.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nodemailerto a version that resolves this vulnerability.Fixed in 8.0.8 - Configuration
Ensure Nodemailer does not disable TLS certificate validation; remove/avoid rejectUnauthorized: false in lib/fetch/index.js so HTTPS connections correctly verify certificates before transmitting OAuth2 token requests.
Nodemailer (lib/fetch/index.js) rejectUnauthorized = true
Event History
Frequently Asked Questions
Which deployments are realistically exposed to token interception?
Deployments using Nodemailer before 8.0.8 that make OAuth2 token requests are exposed when an attacker can occupy a machine-in-the-middle position on the HTTPS connection. The attacker may capture OAuth client secrets, refresh tokens, and access tokens.
Does exploitation require an authenticated application user or user interaction?
No. The vector is network-based, with no privileges or user interaction required, but exploitation has high attack complexity because the attacker must be able to intercept the affected HTTPS traffic.
What is the immediate remediation?
Upgrade Nodemailer to version 8.0.8 or later, where the affected pre-8.0.8 behavior is no longer present.