Product Name: Nodemailer (npm)
Vulnerability: Improper TLS certificate validation vulnerability
Vulnerable Version: <= 8.0.7
On May 27, 2026, a security researcher at Astra Security found an improper TLS certificate validation vulnerability in Nodemailer’s internal HTTPS fetch implementation, affecting versions up to 8.0.7.
If exploited, this vulnerability would allow an attacker positioned as a machine-in-the-middle (MITM) to intercept OAuth2 credential exchanges using self-signed or invalid TLS certificates.
Nodemailer is one of the most widely used email libraries in the Node.js ecosystem, with approximately 15 million weekly downloads on npm and over 10,000 dependent packages. It is heavily integrated into authentication systems, SaaS platforms, transactional email services, and enterprise applications.
A successful exploitation and weaponization of this vulnerability could lead to widespread credential theft and compromise of numerous production deployments worldwide.
Technical Breakdown
The flaw resides in the library’s internal HTTPS fetch implementation and completely bypasses certificate validation during OAuth2 token exchanges.
Given that the NPM ecosystem is already heavily targeted and weaponized by threat actors, this vulnerability represents a particularly high-risk vector for large-scale attacks.
How was it discovered?
While analyzing Nodemailer’s OAuth2 authentication flow, our security researcher noticed that the internal fetch client disabled TLS certificate validation through the use of rejectUnauthorized: false.
To verify the impact, a test was conducted by redirecting the accessUrl to a fake OAuth server with a self-signed certificate. When a token refresh was triggered, Nodemailer sent sensitive credentials (client_secret, refresh_token etc.) to the malicious server without any rejection. This confirmed a machine-in-the-middle (MITM) vulnerability that allows credential interception during the OAuth2 token exchange.
How to replicate the vulnerability
- Set up vulnerable Nodemailer code
- Then set up a malicious OAuth2 endpoint using
node.js/expressserver with a self-signed certificate. - Intercept traffic through DNS poisoning, proxy manipulation, network interception, or the machine-in-the-middle (MITM) technique.
- Successful replication shows the
client_secretandrefresh_token(or authorization code) in the malicious server logs.
Every fortnight our security engineers update DAST vulnerability scanner’s test cases. So we’re always one step ahead.
Impact of Improper TLS Certificate Validation
A critical Improper TLS Certificate Validation vulnerability in Nodemailer versions ≤ 8.0.7 allows machine-in-the-middle (MITM) attackers and malicious mail servers to intercept sensitive OAuth credentials.
The flaw resides in lib/fetch/index.js and affects the OAuth2 token retrieval process used by Nodemailer transports. By default, the library does not properly enforce TLS certificate validation, accepting self-signed, expired, or invalid certificates and failing to verify hostnames and CA chains
The vulnerability could lead to
- Attackers can steal access tokens and refresh tokens during the authentication process.
- Full account compromise of the email provider
- Sensitive data exfiltration
- Exposure of other sensitive credentials transmitted during the OAuth flow
- Compromised accounts can be used to send spam, phishing emails, or malicious content on behalf of the victim.
- Beyond tokens, other credentials or information exchanged during the OAuth2 flow may also be leaked.
Current Status
The issue was responsibly disclosed to the project maintainer. This issue can be tracked under GitHub Advisory GHSA-r7g4-qg5f-qqm2.
What Can You Do?
Users are strongly advised to update Nodemailer version 8.0.8 or later to mitigate this vulnerability.
If it’s not possible due to compatibility issues, implement the following workarounds:
- Use network-level controls(certificate pinning)
- Enforce strict TLS certificate validation by default.
- Reject self-signed, expired, or otherwise invalid certificates.
- Always validate the hostname and the full certificate authority (CA) chain before transmitting any credentials or sensitive data.
- Monitor for unexpected token endpoint traffic
Moreover, Astra Security helps you test for this vulnerability during a manual pentest.
