CVE-2026-82662

Executive Summary

CVE-2026-82662 is a high-severity TLS certificate verification bypass vulnerability in Nodemailer, a widely used Node.js email delivery library. Versions prior to 8.0.8 disable TLS certificate validation in the library's fetch module, allowing an attacker positioned as a machine-in-the-middle (MITM) to intercept OAuth2 token requests and capture OAuth client secrets, refresh tokens, and access tokens transmitted over compromised HTTPS connections. The vulnerability affects any application using Nodemailer for OAuth2-authenticated email sending, with a CVSS score of 6.5 reflecting high confidentiality impact but limited integrity impact, and requires an attacker with network position to exploit.

Technical Analysis

The vulnerability resides in Nodemailer's fetch functionality, specifically within lib/fetch/index.js, where the rejectUnauthorized option is explicitly set to false. This setting disables TLS certificate verification for all HTTPS connections made through this module. The affected code path is invoked when Nodemailer performs OAuth2 token requests — typically the exchange of an authorization code for tokens, or refresh token renewal — against an identity provider's token endpoint.

The attack mechanism is a classic TLS downgrade/impersonation scenario. Normally, rejectUnauthorized: true (the Node.js default) ensures that the certificate presented by the server is validated against a trusted certificate authority, the hostname matches the certificate's Subject Alternative Name (SAN), and the certificate chain is intact. By forcing rejectUnauthorized: false, the application accepts any certificate presented by any server on the network path, including self-signed or otherwise invalid certificates that an attacker can easily generate.

From a cryptographic standpoint, the connection remains "encrypted" in the sense that data is transported over TLS, but the encryption is established with an attacker-controlled key because the attacker presents a fraudulent certificate that the client blindly accepts. The attacker then terminates the TLS session, decrypts the traffic, and re-encrypts it to the legitimate server using a separate TLS session — a full passive and active MITM position.

The practical impact is severe because OAuth2 token requests carry high-value credentials: client secrets, refresh tokens, and access tokens. These are sent as POST body parameters to token endpoints. Once captured, an attacker can use the access token to impersonate the legitimate OAuth2 client application, and more critically, use the refresh token to mint new access tokens indefinitely, maintaining persistent unauthorized access even after the initial token expires.

Note: The OSV package information lists "/" (the root package) as affected with version "0→unfixed," which is unusual and may indicate a packaging anomaly. However, the NVD description clearly states that versions before 8.0.8 are affected. Users should verify the exact versioning scheme of their distribution (npm package vs. bundled system package) when applying remediation.

Exploitation Scenarios

No public PoC exists for this CVE, and the attack chain is inferred from the vulnerability class and NVD description. The following scenario is constructed strictly from the available data.

1. Reconnaissance / Target Identification The attacker needs to position themselves as a MITM on the network path between the Nodemailer application and the OAuth2 identity provider's token endpoint. Suitable positions include: a rogue access point on the same Wi-Fi network as the email server, a compromised router or switch, an ISP-level interception point, or an ARP spoofing scenario on a local segment. The attacker targets organizations that use Nodemailer with OAuth2 for sending email via services such as Google Workspace or Microsoft 365, as these are the most common integrations. Passive reconnaissance can identify SMTP/IMAP traffic or SNI fields revealing connections to OAuth token endpoints.

2. Triggering the Flaw No user interaction is required. The vulnerability triggers automatically whenever the application initiates an OAuth2 token request through Nodemailer's fetch module. This occurs during routine operations such as: initial token acquisition when the application starts, refresh token renewal (typically on an hourly or daily basis), or when sending email with an expired access token. The attacker does not need to cause the request — they simply wait for the application's normal operation and interpose themselves.

3. Payload / Execution Method The attacker generates a TLS certificate for the token endpoint domain (e.g., oauth2.googleapis.com or login.microsoftonline.com) signed by a certificate authority the attacker controls, or uses a self-signed certificate. Because the client has rejectUnauthorized: false, this fraudulent certificate is accepted without validation. The attacker then proxies the TCP connection, establishing a legitimate TLS session with the real token endpoint while presenting the fraudulent certificate to the victim application. This is a purely passive interception — no payload injection into the application itself is required.

4. Post-Exploitation Impact Upon capturing the OAuth2 token request, the attacker extracts:

• OAuth client secret: Enables the attacker to authenticate as the legitimate application to the OAuth provider, potentially enabling account-wide access or token generation for other scopes.
• Refresh token: Most critically, this allows ongoing token minting. The attacker can repeatedly request new access tokens, maintaining valid credentials indefinitely.
• Access token: Immediate impersonation of the application's identity for the token's validity period, granting access to the protected resources (e.g., the organization's email sending quota, mailbox access if scoped accordingly).

The attacker can then send emails as the organization, read sent mail, or access any other resources the OAuth scopes permit. Since OAuth2 tokens are credentials, the compromise persists beyond the specific network session, and remediation requires credential revocation at the identity provider level.

Impact Assessment

The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N) indicates: network attack vector, high attack complexity (requires MITM position), no privileges required, no user interaction, high confidentiality impact, low integrity impact, and no availability impact.

This scoring accurately reflects the real-world severity. The high confidentiality impact is justified: OAuth2 token captures expose client secrets, refresh tokens, and access tokens — all high-value secrets. The low integrity impact reflects the fact that the attacker can potentially modify email content or inject malicious traffic during the MITM session, but this is secondary to the credential theft. There is no availability impact as the attacker does not disrupt service.

The affected systems are any Node.js applications using Nodemailer 8.0.x prior to 8.0.8 (and earlier 7.x/6.x versions) with OAuth2 authentication enabled. Given Nodemailer's widespread adoption (tens of millions of npm downloads monthly), this includes a broad range of applications: e-commerce platforms sending order confirmations, SaaS products sending transactional email, internal monitoring systems, and marketing automation tools. The blast radius is amplified by the fact that a single compromised refresh token grants prolonged access, and the MITM position necessary for exploitation can be achieved at multiple points in the network path between a cloud-hosted application and the identity provider.

The EPSS score of 0.00124 (2.4th percentile) indicates low exploitation likelihood currently, likely because no public exploit exists and the attack requires network position. However, the severity of the exposure if exploited in a specific target environment justifies priority remediation.

Detection Guidance

Sigma Rule

title: Nodemailer TLS Certificate Verification Disabled (CVE-2026-82662)
id: 4f9d9b13-2c9e-4a12-8f8c-6b3a1d2e4f5a
status: experimental
description: Detects library loading of Nodemailer versions vulnerable to CVE-2026-82662 where TLS verification is disabled, or runtime behavior indicating rejectUnauthorized=false.
author: Valtersit Threat Intel
logsource:
    category: process_creation
    product: linux
detection:
    selection_node:
        Image|endswith:
            - '/node'
            - '/nodejs'
    selection_require:
        ProcessCommandLine|contains|all:
            - 'nodemailer'
            - 'rejectUnauthorized'
    selection_npm:
        ProcessCommandLine|contains:
            - 'npm install nodemailer' 
    condition: selection_node and selection_require
    condition_npm_install: selection_node and selection_npm
level: medium
falsepositives:
    - Legitimate testing environments with intentional TLS verification disabled
    - Developers inspecting dependency source code
tags:
    - attack.t1557
    - cve.2026.82662

YARA Rule

rule nodemailer_tls_verification_disabled_CVE_2026_82662
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects Nodemailer source containing rejectUnauthorized:false in lib/fetch/index.js, indicating CVE-2026-82662 vulnerable code"
        cve = "CVE-2026-82662"
        date = "2026-03-01"
        score = 70
    strings:
        $a = "rejectUnauthorized" ascii wide
        $b = "false" ascii wide
        $c = "lib/fetch/index.js" ascii wide
        $d = "Nodemailer" ascii wide noprime
        $e = "oauth2" ascii wide nocase
    condition:
        filesize < 2MB and
        $a and $b and $c and
        (1 of ($d,$e))
}

Suricata IDS Rule

alert tls any any -> any any (msg:"Nodemailer Client Accepting Invalid TLS Certificate - CVE-2026-82662"; flow:established,to_client; tls.cert_subject; content:"CN="; tls.store; tls.cert_notbefore; sid:202682662; rev:1; metadata:attack.target T1557; classtype:policy-violation; reference:cve,2026-82662;)

Note: This rule detects a client accepting a suspicious TLS certificate (self-signed or invalid) in a network session that may involve Nodemailer's OAuth2 token requests. It is an anomaly-based heuristic rule; adjust thresholds based on baseline traffic.

Elastic Detection

// Detect Node.js processes spawning with Nodemailer module loaded and OAuth2 token endpoint communication
// This EQL query targets Windows and Linux hosts running Node.js applications
sequence by process.entity_id
  [process where event.action == "exec" and process.name == "node"]
  [network where process.name == "node" and destination.port == 443 and
   network.protocol == "tls" and
   (url.domain in ("oauth2.googleapis.com", "accounts.google.com", "login.microsoftonline.com") or
    dns.question.name in ("oauth2.googleapis.com", "accounts.google.com", "login.microsoftonline.com"))]

Note: For host-level detection, combine with file and code-signing checks. This EQL is designed for the Elastic SIEM.

Splunk SPL Query

index=main sourcetype=linux:syslog OR sourcetype=WinEventLog OR sourcetype=xmlwineventlog
| search "nodemailer" OR "lib/fetch/index.js" OR "rejectUnauthorized"
| eval cve = "CVE-2026-82662"
| eval severity = case(like(process, "%npm%") or like(process, "%node%"), "high", 1=1, "medium")
| stats count by host, source, process, process_exec, cve
| table host, source, process, process_exec, count, cve
| sort - count

Note: This query searches for Node.js process execution logs and npm install activity referencing Nodemailer. For network-based detection, add the Suricata/Zeek logs.

Wazuh OSSEC Rule

<group name="application,">
    <rule id="100862" level="10">
        <decoded>
            <program_name>node</program_name>
        </decoded>
        <match>Nodemailer</match>
        <match>rejectUnauthorized</match>
        <match>lib/fetch/index.js</match>
        <regex>rejectUnauthorized.\s*:\s*false</regex>
        <description>Nodemailer vulnerable version detected with TLS verification disabled (CVE-2026-82662)</description>
        <group>cve-2026-82662,tls-mitm,</group>
        <mitre>
            <id>T1557</id>
            <technique>Adversary-in-the-Middle</technique>
        </mitre>
    </rule>

    <rule id="100863" level="5">
        <decoded>
            <program_name>npm</program_name>
        </decoded>
        <match>nodemailer</match>
        <description>Nodemailer installation detected - verify version is >= 8.0.8</description>
        <group>cve-2026-82662,</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED (single source, OSV, not independently confirmed) As of this writing, the patch is claimed via a single OSV entry, with no vendor advisory or second-source confirmation. Nodemailer maintainers have not yet published a GitHub Advisory or changelog entry independently.

Immediate Mitigations (do these today):

1. Upgrade Nodemailer to version 8.0.8 or later if available in your registry/environment. Verify the fix by inspecting lib/fetch/index.js for rejectUnauthorized defaulting to true.
2. Enforce a Node.js version with NODE_TLS_REJECT_UNAUTHORIZED=1 environment variable as a defense-in-depth measure (note: this is a process-wide setting and may break other functionality; test thoroughly).
3. Network layer mitigation: Implement strict egress filtering and TLS inspection (e.g., via an enterprise proxy) to prevent direct connections from application servers to OAuth token endpoints, forcing traffic through a controlled inspection point where certificate validation is enforced.
4. Rotation of all potentially exposed OAuth2 credentials: Rotate client secrets, revoke and re-issue refresh tokens, and invalidate access tokens for all impacted applications. This is critical even after patching, as credentials may already be compromised.

Patch / Upgrade Steps:

1. Audit all deployed applications: npm list nodemailer or yarn why nodemailer to identify affected versions.
2. Upgrade: npm install nodemailer@^8.0.8 or yarn add nodemailer@^8.0.8, then retest email functionality.
3. Verify the patch applied correctly by grepping the installed package: grep -r "rejectUnauthorized" node_modules/nodemailer/lib/fetch/.
4. Monitor OSV and Nodemailer GitHub releases for independent confirmation and potential follow-up advisories.

Long-Term Hardening:

1. Automated dependency scanning: Integrate Dependabot, Renovate, or Snyk into CI/CD pipelines to automatically flag vulnerable versions.
2. Supply chain controls: Sign dependencies with locked hashes (integrity checks in package-lock.json) and perform regular npm audit runs.
3. Architectural improvements: Consider delegating OAuth2 token management to dedicated libraries that enforce TLS verification by default, or use a dedicated OAuth2/OpenID Connect client (e.g., openid-client, oauth2-client) rather than relying on the email library's built-in fetch.
4. Network segmentation: Isolate application servers from direct internet access where possible, routing outbound traffic through an authenticated proxy with mandatory certificate pinning.
5. Runtime monitoring: Deploy the detection rules above to identify vulnerable deployments and anomalous TLS behavior.

References

1. NVD Entry for CVE-2026-82662: https://nvd.nist.gov/vuln/detail/CVE-2026-82662
2. OSV Vulnerability Database (patch source): https://osv.dev/vulnerability/CVE-2026-82662
3. Nodemailer Official Repository (GitHub): https://github.com/nodemailer/nodemailer — monitor for release 8.0.8 and changelog.
4. Node.js TLS Documentation (for understanding rejectUnauthorized and TLS verification): https://nodejs.org/api/tls.html
5. CWE-295 Improper Certificate Validation: https://cwe.mitre.org/data/definitions/295.html

Exploit-in-the-Wild Evidence: None known. No public PoC or Nuclei template exists. CISA KEV list does not include this CVE. No associated threat actor campaigns have been identified as of this report. The absence of public exploits and low EPSS score (0.00124, 2.4th percentile) suggests exploitation is not currently widespread, but the vulnerability is high-value for targeted attacks due to the credential exposure potential.