CVE-2026-82662
Received Received - Intake

Nodemailer OAuth2 Token Leak via TLS Bypass

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: VulnCheck

Description
Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitted over compromised HTTPS connections.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-82662
EUVD
EUVD-2026-68440

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nodemailer nodemailer to 8.0.8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Nodemailer before version 8.0.8 has a vulnerability where TLS certificate verification is disabled in the lib/fetch/index.js file using rejectUnauthorized: false. This allows attackers in a man-in-the-middle position to intercept OAuth2 token requests and capture sensitive data like OAuth client secrets, refresh tokens, and access tokens transmitted over HTTPS.

Detection Guidance

Check Nodemailer version with npm list nodemailer. If version is below 8.0.8, the system is vulnerable. Inspect lib/fetch/index.js for rejectUnauthorized: false setting.

Impact Analysis

Attackers could intercept OAuth2 credentials, leading to unauthorized email access, persistent token abuse, mailbox compromise, or interception of OAuth responses. Sensitive data such as client secrets and tokens could be stolen, enabling further attacks.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Compromised OAuth tokens may result in unauthorized data exposure, triggering compliance violations and potential legal consequences.

Mitigation Strategies

Update Nodemailer to version 8.0.8 or later. Remove any rejectUnauthorized: false settings in lib/fetch/index.js. Ensure TLS certificate validation is enabled in all OAuth2 token requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82662. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart