Nodemailer CVE-2026-82662

The application must use Nodemailer's built-in OAuth2 XOAuth2 transport, specifically configurations where Nodemailer itself initiates outbound HTTPS requests to retrieve OAuth2 tokens - not deployments where tokens are obtained externally and passed to Nodemailer as pre-fetched bearer credentials, which do not traverse the vulnerable code path. The attacker must hold a machine-in-the-middle position on the network path between the Nodemailer process and the OAuth2 token endpoint; this requires local network access, DNS poisoning capability, compromised routing infrastructure, or a rogue network device - it is not achievable by an arbitrary remote attacker without first achieving such positioning. No attacker authentication or application account is required. Exploitation is bounded by the AC:H/AT:P CVSS metrics: reliably achieving a MITM position is a non-trivial precondition that significantly narrows the exploitable attacker population relative to a simple unauthenticated remote exploit.

The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N) accurately represents the threat profile: the attack is network-accessible but gated behind a meaningful prerequisite - the attacker must hold a MITM position (AC:H/AT:P), which limits the attacker pool compared to direct remote exploitation. No attacker authentication is required once the position is achieved. The confidentiality impact (VC:H) is severe because captured OAuth tokens - particularly refresh tokens - grant persistent access well beyond the initial interception window, potentially enabling full account takeover of downstream services. A reporter-confirmed PoC exists and was validated through runtime testing, making exploitation feasible for capable threat actors. No CISA KEV listing means active exploitation is unconfirmed, but the combination of a public PoC, a high-prevalence library, and AC:H (not AC:L) makes this a genuine priority rather than a theoretical risk. EPSS data was not provided in the submission and cannot be assessed; the AC:H gating factor suggests automated mass exploitation is unlikely, but targeted exploitation is plausible against high-value targets. The 8.3 CVSS 4.0 score is consistent with the actual threat: serious, but constrained by the MITM prerequisite.

An attacker with ARP-spoofing or rogue-DNS capability on the same network segment as a Node.js application using Nodemailer's OAuth2 transport intercepts the outbound HTTPS token request and presents a self-signed TLS certificate; Nodemailer accepts it without complaint due to rejectUnauthorized: false. The OAuth2 client secret and refresh token are transmitted and captured, giving the attacker persistent delegated access to the victim's email or API account. A reporter-verified PoC demonstrating this exact flow against a self-signed HTTPS OAuth endpoint exists and is referenced in GHSA-r7g4-qg5f-qqm2.