Description

Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitted over compromised HTTPS connections.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-31T09:17:04.093Z",
  "pubdate": "2026-08-31T09:17:04.093Z",
  "executiveSummary": "Nodemailer versions prior to 8.0.8 are susceptible to a critical TLS certificate verification bypass. The vulnerability, located in the lib/fetch/index.js file, involves the explicit configuration of the 'rejectUnauthorized' parameter to 'false'. This security misconfiguration disables the validation of server-side certificates during the establishment of TLS connections, effectively neutralizing the integrity and authenticity verification provided by the protocol.\nThe primary risk associated with this flaw is the facilitation of man-in-the-middle (MITM) attacks. By circumventing certificate validation, an attacker capable of intercepting network traffic can present a fraudulent certificate to the application, masquerading as the legitimate destination server. This allows for the interception and decryption of sensitive data transmitted during OAuth2 token requests, including client secrets, refresh tokens, and access tokens. The vulnerability poses a significant risk to the confidentiality of identity and authentication data, potentially leading to unauthorized access to downstream services or email accounts linked to the compromised OAuth credentials.",
  "technicalDetails": "The vulnerability resides in the implementation of the HTTP fetch utility within Nodemailer, specifically in the file 'lib/fetch/index.js'. The root cause is the hardcoded assignment of 'rejectUnauthorized: false' within the TLS options object used during the TLS handshake process. By setting this property to false, the underlying Node.js 'https' module is instructed to ignore any certificate validation errors, including expired certificates, self-signed certificates, or certificates issued by untrusted Certificate Authorities (CAs).\nIn a standard secure communication scenario, the client validates the server's identity by verifying the certificate chain against trusted root CAs. When 'rejectUnauthorized' is disabled, this mechanism is entirely bypassed. An attacker positioned in a man-in-the-middle capacity—such as via DNS spoofing, ARP cache poisoning, or compromised network infrastructure—can intercept outbound traffic intended for the authentication provider. Because the application no longer verifies the authenticity of the peer, the attacker can present a malicious certificate, establish an encrypted tunnel between the client and the attacker, and then proxy that connection to the legitimate service provider.\nThe attack flow proceeds as follows: 1. The attacker monitors the network path between the client running the vulnerable Nodemailer instance and the OAuth2 identity provider. 2. When the application initiates an OAuth2 flow (e.g., requesting an access or refresh token), the attacker intercepts the request. 3. The attacker terminates the TLS connection using an arbitrary or spoofed certificate; because Nodemailer is configured to ignore errors, the handshake succeeds. 4. The application transmits the OAuth2 client credentials and token data over the connection. 5. The attacker captures these sensitive payloads in plaintext. 6. The attacker may then forward the request to the legitimate provider to avoid detection or simply terminate the session after exfiltrating the credentials.\nThis vulnerability specifically impacts Nodemailer versions prior to 8.0.8. Exploitation does not require prior authentication or elevated privileges, as it targets the transport layer during the authentication request phase. The exposure is limited to network segments where the attacker can intercept traffic, making it particularly dangerous in environments such as public Wi-Fi, compromised local area networks, or transit infrastructure."
}