CVE-2026-82662: Nodemailer

Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days.

Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitted over compromised HTTPS connections.

Affected products

• Nodemailer Nodemailer: before 8.0.8 (fixed in 8.0.8)

Published 2026-08-31. Last modified 2026-09-10.