Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to… (CVE-2026-82662)

The vulnerability identified as CVE-2026-82662 affects Nodemailer versions prior to 8.0.8. It involves the disabling of TLS certificate verification in the lib/fetch/index.js file through the rejectUnauthorized flag being set to false. This misconfiguration enables attackers in a man-in-the-middle position to intercept OAuth2 token requests, thereby capturing sensitive OAuth credentials such as client secrets, refresh tokens, and access tokens that are sent over what should be secure HTTPS connections.

Successful exploitation of this vulnerability allows an attacker with network interception capabilities to capture sensitive OAuth2 tokens and client secrets. This compromises the confidentiality of authentication credentials, potentially enabling unauthorized access to services relying on these tokens. The integrity and availability impacts are low, but the confidentiality impact is high due to exposure of sensitive authentication data.

A fix is available in Nodemailer version 8.0.8 and later, which restores proper TLS certificate verification by not disabling rejectUnauthorized. Users should upgrade to version 8.0.8 or later to remediate this vulnerability. No other mitigation guidance is provided or necessary as the issue is resolved by this update.