# Duplicate Advisory: Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception

Source: https://junglewise.ai/threats/duplicate-advisory-nodemailer-improper-tls-certificate-validation-in-f2e6133e  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-31  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 6.5 · Published 2026-08-31

## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-r7g4-qg5f-qqm2. This link is maintained to preserve external references.

## Original Description
Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitted over compromised HTTPS connections.

Technologies: [nodemailer (npm)](https://junglewise.ai/threats/technologies/npm-nodemailer). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 6.5, published 31 August 2026.

**Which products and versions are affected?** nodemailer (npm) <= 8.0.7.

**Is there a fix for This vulnerability?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected?** Check whether you run nodemailer (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- nodemailer (npm) <= 8.0.7

## Related threats

- [Nodemailer addressparser RFC 5322 comment parsing bypass](https://junglewise.ai/threats/nodemailer-a-nested-comment-ends-early-in-addressparser-releasing-the-4e80613c)
- [Nodemailer addressparser group terminator bypass in quoted strings](https://junglewise.ai/threats/nodemailer-a-inside-a-quoted-string-or-comment-ends-an-address-group-b8b045f9)
- [Nodemailer addressparser angle-addr parsing bypass](https://junglewise.ai/threats/nodemailer-a-inside-a-quoted-local-part-ends-an-angle-addr-early-in-28663cfb)
- [Nodemailer quadratic DKIM header unfolding denial of service](https://junglewise.ai/threats/duplicate-advisory-nodemailer-quadratic-o-n-2-dkim-header-unfolding-a2b86ca5)
- [Nodemailer SMTP parser denial of service](https://junglewise.ai/threats/cve-2026-110872-nodemailer-from-3-0-0-before-10-0-10-contains-a-quadratic)