TLS Certificate Validation Bypass in Nodemailer by Nodemailer
CVE-2026-82662

8.3HIGH

Key Information:

Vendor

Nodemailer

Status
Nodemailer
Vendor
CVE Published:
31 August 2026

What is CVE-2026-82662?

A significant vulnerability in Nodemailer prior to version 8.0.8 allows the disabling of TLS certificate verification. This exposes users to potential man-in-the-middle attacks, where attackers can intercept OAuth2 token requests. Through this flaw, sensitive data such as OAuth client secrets, refresh tokens, and access tokens can be captured over compromised HTTPS connections, putting user security at risk.

Affected Version(s)

nodemailer 0 < 8.0.8

nodemailer 8.0.8

References

https://github.com/nodemailer/nodemailer/security/advisor...
vendor-advisory
https://www.vulncheck.com/advisories/nodemailer-before-8....
third-party-advisory

CVSS V4

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Venukamatchi
.