CVE-2026-82662: Nodemailer Information Disclosure Flaw

CVE-2026-82662 Overview

CVE-2026-82662 is a TLS certificate validation bypass in Nodemailer versions before 8.0.8. The library disables certificate verification in lib/fetch/index.js by setting rejectUnauthorized: false on outbound HTTPS requests. This behavior affects OAuth2 token exchanges initiated by Nodemailer. An attacker positioned between the Node.js application and the OAuth2 provider can intercept and decrypt these HTTPS connections. The captured traffic exposes OAuth client secrets, refresh tokens, and access tokens. The weakness maps to CWE-295: Improper Certificate Validation.

Critical Impact
Machine-in-the-middle attackers can capture OAuth2 credentials, including client secrets and refresh tokens, enabling persistent unauthorized access to mail accounts and connected services.

Affected Products

Nodemailer versions prior to 8.0.8
Node.js applications using Nodemailer OAuth2 authentication flows
Server-side email integrations relying on lib/fetch/index.js for token requests

Discovery Timeline

2026-08-31 - CVE-2026-82662 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-82662

Vulnerability Analysis

Nodemailer performs outbound HTTPS requests through its internal fetch helper located at lib/fetch/index.js. In versions before 8.0.8, the helper passes rejectUnauthorized: false to the Node.js https module. This flag instructs the TLS client to complete handshakes even when the server certificate is untrusted, self-signed, or issued to a different hostname.

OAuth2 authentication flows in Nodemailer use this helper to reach token endpoints. When the client trusts any presented certificate, an attacker with network position can terminate the TLS session, present a forged certificate, and forward traffic to the legitimate endpoint. The attacker captures the plaintext OAuth2 exchange, including client identifiers, client secrets, authorization codes, refresh tokens, and issued access tokens.

Stolen refresh tokens remain valid until revocation and permit long-term impersonation of the compromised mail account. Client secrets extend the attacker's reach to any tenant using the same OAuth2 application registration.

Root Cause

The root cause is an insecure default in the internal fetch utility. Setting rejectUnauthorized: false disables certificate chain verification, hostname validation, and revocation checks for every request routed through the helper. The setting is not exposed as an opt-in and applies uniformly to OAuth2 token endpoints that must be treated as high-trust destinations.

Attack Vector

Exploitation requires a machine-in-the-middle position on the network path between the application host and the OAuth2 provider. Suitable positions include compromised upstream proxies, hostile Wi-Fi, rogue egress gateways, DNS poisoning combined with certificate spoofing, or a compromised transit provider. The attacker terminates the TLS connection with a forged certificate, records the OAuth2 request and response, and relays traffic to the real endpoint. The Nodemailer client accepts the forged certificate without warning and completes the token exchange normally.

See the GitHub Security Advisory GHSA-r7g4-qg5f-qqm2 and the VulnCheck Advisory for additional technical detail.

Detection Methods for CVE-2026-82662

Indicators of Compromise

Nodemailer package version below 8.0.8 present in package.json, package-lock.json, or installed node_modules
Outbound TLS connections from application hosts to OAuth2 provider domains presenting unexpected certificate issuers
OAuth2 audit logs showing token issuance from unusual client IP addresses or geolocations
Unexpected refresh token grants or access token replays against mail provider APIs

Detection Strategies

Perform software composition analysis on Node.js projects to enumerate Nodemailer versions in use
Inspect application source and dependencies for calls to lib/fetch/index.js and for rejectUnauthorized: false in TLS options
Monitor OAuth2 provider logs for anomalous token grants, refresh events, and API activity following authentication
Correlate outbound TLS metadata from application servers with expected OAuth2 endpoint certificates using JA3 or certificate transparency lookups

Monitoring Recommendations

Alert on new or unexpected certificate authorities observed on connections to Microsoft, Google, and other OAuth2 token endpoints from server workloads
Track OAuth2 refresh token usage patterns and flag reuse from new source addresses
Log Node.js runtime TLS negotiation events where certificate verification is disabled

How to Mitigate CVE-2026-82662

Immediate Actions Required

Upgrade Nodemailer to version 8.0.8 or later across all Node.js applications
Rotate OAuth2 client secrets, refresh tokens, and access tokens used by Nodemailer integrations
Audit OAuth2 provider logs for token issuance and API activity during the exposure window
Restrict outbound egress from application servers to known OAuth2 endpoints through an inspected proxy

Patch Information

Upgrade to Nodemailer 8.0.8 or later. The fix removes the rejectUnauthorized: false setting from lib/fetch/index.js so that TLS certificate verification is enforced on OAuth2 token requests. Refer to the GitHub Security Advisory GHSA-r7g4-qg5f-qqm2 for release details.

Workarounds

Route OAuth2 traffic through a controlled forward proxy that enforces certificate pinning to provider endpoints
Disable OAuth2 authentication in Nodemailer and use application passwords or short-lived credentials until patching is complete
Isolate mail-sending workloads on network segments that do not traverse untrusted intermediaries

bash

# Upgrade Nodemailer to a patched release
npm install nodemailer@^8.0.8

# Verify the installed version
npm ls nodemailer

# Audit remaining dependencies for the vulnerable range
npm audit