CyberRota Analysis
AI-GeneratedNodemailer versions prior to 8.0.8 are vulnerable due to the disabling of TLS certificate verification, which allows attackers to intercept OAuth2 token requests. This flaw enables adversaries to capture sensitive OAuth client secrets, refresh tokens, and access tokens over compromised HTTPS connections. Organizations utilizing Nodemailer for email services should prioritize patching to mitigate the risk of credential theft and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitted over compromised HTTPS connections.