Medium severity6.5NVD Advisory· Published Aug 31, 2026

CVE-2026-82662

Description

Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitted over compromised HTTPS connections.

Affected products

Nodemailer/Nodemailerllm-fuzzy
Range: <8.0.8

Patches

Vulnerability mechanics

References

github.com/nodemailer/nodemailer/security/advisories/GHSA-r7g4-qg5f-qqm2nvd
www.vulncheck.com/advisories/nodemailer-before-8.0.8-tls-certificate-validation-bypassnvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000