CVE-2026-82662

Name of the Vulnerable Software and Affected Versions Nodemailer versions prior to 8.0.8

Description Nodemailer disables TLS certificate verification in its internal HTTPS fetch client located in lib/fetch/index.js by setting rejectUnauthorized: false. This configuration causes OAuth2 token requests to trust invalid or self-signed HTTPS certificates, bypassing hostname validation and CA chain verification. Consequently, an attacker in a machine-in-the-middle position can intercept sensitive OAuth credentials transmitted over compromised HTTPS connections, including the client secret, refresh token, and access tokens.

Recommendations Update Nodemailer to version 8.0.8 or later.