CVE-2026-82662

Nodemailer versions before 8.0.8 disable TLS certificate verification in its internal HTTP client (lib/fetch/index.js) by setting rejectUnauthorized to false, a case of improper certificate validation (CWE-295). The flaw is triggered when Nodemailer performs OAuth2 token requests, such as exchanging refresh tokens for access tokens; an attacker positioned on the network path between the application and the token endpoint can present any certificate and intercept the HTTPS traffic. In doing so, the attacker captures sensitive OAuth2 credentials in transit, including OAuth client secrets, refresh tokens, and access tokens, which can be reused to access the associated mail account. Any application running an affected Nodemailer version and authenticating via OAuth2 is exposed, though the attacker must already hold a machine-in-the-middle position (reflected in the CVSS 4.0 high attack complexity and present attack requirements). Exploitation is not currently known: there is no public proof-of-concept, the EPSS probability is 0.1% over 30 days, and the issue is not in CISA KEV.

What to do: Upgrade to Nodemailer 8.0.8 or later, which restores TLS certificate verification in the bundled fetch implementation. Audit whether your deployments authenticate with OAuth2 (the only flows affected here); until patching, avoid routing OAuth2 token requests across untrusted network segments and treat any suspected interception as grounds to rotate OAuth client secrets and refresh tokens.