Nodemailer improper TLS certificate validation in OAuth2 fetch

Executive brief

Nodemailer, a popular email-sending library for Node.js, contains a security flaw where it fails to properly verify the identity of servers when fetching OAuth2 security tokens. This allows an attacker positioned on the same network to intercept sensitive login credentials, such as client secrets and access tokens. If exploited, this could lead to unauthorized access to email accounts and the ability for attackers to send fraudulent emails.

Technical details

Nodemailer's internal HTTPS fetch client in `lib/fetch/index.js` hardcodes `rejectUnauthorized: false`, which disables TLS certificate verification. This vulnerability affects the OAuth2 transport flow during XOAuth2 token generation and retrieval. A machine-in-the-middle (MITM) attacker can present a self-signed or invalid certificate to intercept the `client_secret`, `refresh_token`, and `access_token` transmitted during the exchange. The issue is fixed in version 8.0.8 by ensuring proper peer certificate validation.

Affected products

• nodemailer nodemailer <= 8.0.7

Timeline

• 2026-05-26: disclosed: Initial disclosure on GitHub
• 2026-06-15: advisory: GitHub Advisory published
• 2026-06-15: patched: Version 8.0.8 released

References

• https://api.github.com/users/Venukamatchi
• https://github.com/Venukamatchi
• https://api.github.com/users/Venukamatchi/gists%7B/gist_id%7D
• https://api.github.com/users/Venukamatchi/repos
• https://avatars.githubusercontent.com/u/176712515?v=4
• https://api.github.com/users/Venukamatchi/events%7B/privacy%7D