Skip to main content

Nodemailer CVE-2026-82662

| EUVDEUVD-2026-68440 HIGH
Improper Certificate Validation (CWE-295)
2026-08-31 VulnCheck GHSA-frj6-5rhh-vwfw
Authentication Bypass Nodemailer
8.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.3 HIGH
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.5 MEDIUM

Requires network MITM position (AC:H, no PR:N bypass needed); OAuth token capture yields high confidentiality impact; limited integrity impact from potential response injection; no availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE
6.5 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Red Hat
6.5 MEDIUM
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

5
POC Analysis Generated
Sep 12, 2026 - 19:26 vuln.today
CVE Published
Aug 31, 2026 - 10:50 cve.org
HIGH 8.3
Patch available
Aug 31, 2026 - 10:16 EUVD
Source Code Evidence Fetched
Aug 31, 2026 - 09:30 vuln.today
Analysis Generated
Aug 31, 2026 - 09:30 vuln.today

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 18 npm packages depend on nodemailer (11 direct, 9 indirect)

Ecosystem-wide dependent count for version 8.0.8.

DescriptionCVE.org

Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitted over compromised HTTPS connections.

AnalysisAI

TLS certificate verification is disabled by hardcoded rejectUnauthorized: false in Nodemailer's internal HTTPS fetch client (lib/fetch/index.js), exposing OAuth2 token exchanges to machine-in-the-middle interception in all versions prior to 8.0.8. Any attacker with a MITM position on the network path between a Nodemailer-based application and its OAuth2 token endpoint can silently capture OAuth client secrets, refresh tokens, and access tokens from connections that appear valid to the application. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The application must use Nodemailer's built-in OAuth2 XOAuth2 transport, specifically configurations where Nodemailer itself initiates outbound HTTPS requests to retrieve OAuth2 tokens - not deployments where tokens are obtained externally and passed to Nodemailer as pre-fetched bearer credentials, which do not traverse the vulnerable code path. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N) accurately represents the threat profile: the attack is network-accessible but gated behind a meaningful prerequisite - the attacker must hold a MITM position (AC:H/AT:P), which limits the attacker pool compared to direct remote exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade Nodemailer to version 8.0.8 or later, which resolves the root cause per GHSA-r7g4-qg5f-qqm2. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Nodemailer

View all
CVE-2020-7769 CRITICAL POC
9.8 Nov 12

This affects the package nodemailer before 6.4.16. Rated critical severity (CVSS 9.8), this vulnerability is remotely ex
CVE-2021-23400 HIGH POC
8.8 Jun 29

The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain n
CVE-2026-82659 HIGH POC
7.1 Aug 31

Sandbox bypass in nodemailer <= 9.0.0 exposes arbitrary file read and full-response SSRF to any authenticated applicatio
CVE-2026-82854 CRITICAL
9.3 Aug 31

SMTP command injection in Nodemailer before 8.0.4 lets attackers smuggle arbitrary SMTP verbs (notably RCPT TO) into out
CVE-2026-90776 HIGH POC
8.7 Sep 13

Quadratic time complexity in Nodemailer's addressparser component, versions 9.1.0 through 10.0.4, allows remote unauthen
CVE-2026-82853 MEDIUM
6.9 Aug 31

SMTP command injection in Nodemailer (npm) versions up to and including 8.0.4 allows an attacker who can influence the t
CVE-2026-82661 MEDIUM
5.3 Aug 31

CRLF injection in Nodemailer's List-* header construction allows any application-level user with control over list comme
CVE-2026-82660 MEDIUM
5.3 Aug 31

Nodemailer's jsonTransport transport fails to enforce disableFileAccess and disableUrlAccess controls during message nor
CVE-2026-3455 LOW POC
2.0 Mar 03

Versions of the package mailparser versions up to 3.9.3 is affected by cross-site scripting (xss) (CVSS 6.1).

Same weakness CWE-295 – Improper Certificate Validation

View all
CVE-2015-3152 MEDIUM POC
5.9
CVE-2026-85102 CRITICAL POC
9.8
CVE-2017-2800 CRITICAL POC
9.8
CVE-2014-1266 HIGH POC
7.4
CVE-2022-47758 CRITICAL POC
9.8
CVE-2025-68121 CRITICAL POC
10.0
CVE-2025-29331 CRITICAL POC
9.8
CVE-2025-32878 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected
SUSE Linux Enterprise Micro 5.5 Not-Affected

Share

CVE-2026-82662 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy