CVE-2026-82662 in Nodemailer
Summary
by MITRE • 08/31/2026
Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitted over compromised HTTPS connections.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/31/2026
The vulnerability identified in Nodemailer versions prior to 8.0.8 represents a critical security misconfiguration within the library's transport mechanism for handling email delivery via SMTP servers that utilize TLS encryption. Specifically, the flaw resides in lib/fetch/index.js where the configuration option rejectUnauthorized is explicitly set to false. In standard Transport Layer Security implementations, this flag serves as the primary control for validating the remote server's X.509 certificate against a trusted Certificate Authority chain and verifying that the hostname matches the certificate subject or Subject Alternative Names. By disabling this verification, Nodemailer effectively operates in an insecure mode where it will accept any TLS connection regardless of whether the presented certificate is self-signed, expired, mismatched, or issued by an untrusted authority. This behavior fundamentally undermines the core purpose of HTTPS and STARTTLS protocols, which rely on mutual authentication to establish a secure channel between client and server.
From a technical perspective, this configuration error creates a classic Man-in-the-Middle attack vector. When Nodemailer initiates a connection to an SMTP server using OAuth2 for authentication, it transmits sensitive credentials including the OAuth client secret, refresh tokens, and access tokens over what appears to be an encrypted channel. However, because certificate verification is disabled, an attacker positioned in the network path can intercept this traffic by presenting their own fraudulent TLS certificate without triggering a connection error or warning within the Nodemailer application logic. The library proceeds to establish the session with the malicious endpoint, believing it has successfully connected to the legitimate mail server. Consequently, all subsequent data exchanged during this session is encrypted only under keys controlled by the attacker rather than the intended recipient infrastructure.
The operational impact of this vulnerability is severe due to the high sensitivity of OAuth2 credentials. Unlike simple password authentication where a single compromised credential might be rotated easily, OAuth2 tokens often grant broad access scopes and may have longer lifespans or refresh capabilities that allow persistent unauthorized access. An attacker who captures these tokens can impersonate the application or user across various services integrated with the same identity provider. This includes accessing email contents stored in cloud providers, reading sensitive communications, sending malicious emails on behalf of the victim to damage reputation or launch further phishing campaigns, and potentially escalating privileges if the OAuth2 scopes include administrative permissions for other linked APIs such as Google Workspace, Microsoft 365, or Salesforce. The risk is exacerbated by the fact that many developers integrate Nodemailer into backend services handling bulk communications where automated token refreshes occur silently in the background, making detection of unauthorized usage difficult without rigorous log monitoring and anomaly detection systems.
This vulnerability aligns with CWE-295 Improper Certificate Validation, as it involves failing to properly validate a certificate presented during TLS negotiation. It also maps directly to MITRE ATT&CK technique T1078 Valid Accounts, specifically the sub-technique of using legitimate credentials obtained through interception or theft. Furthermore, the mechanism facilitates Credential Access via Network Sniffing (T1056) and potentially Account Manipulation if the attacker uses the stolen tokens to modify account settings or add backdoor access. The root cause is often attributed to developers attempting to bypass certificate errors during development or testing phases by setting rejectUnauthorized to false but failing to revert this change before deploying to production environments, or relying on third-party configurations that inadvertently disable security checks for convenience rather than necessity.
Mitigation strategies must prioritize the restoration of strict TLS validation practices. The immediate remediation involves upgrading Nodemailer to version 8.0.8 or later where this default behavior has been corrected or properly scoped. For organizations unable to upgrade immediately, it is imperative to audit all instances in the codebase where nodemailer.createTransport is configured and ensure that tls options do not include rejectUnauthorized set to false unless absolutely necessary for specific internal testing scenarios with known self-signed certificates, which should never occur in production. If custom TLS configurations are required, developers must explicitly manage certificate pinning or use a trusted Certificate Authority bundle rather than disabling verification entirely. Additionally, implementing network-level monitoring and deploying intrusion detection systems can help identify anomalous outbound connections to unexpected IP addresses or domains that may indicate active exploitation of this flaw. Regular security audits focusing on dependency management and configuration drift are essential to prevent such misconfigurations from persisting in production environments.