GHSA-FRJ6-5RHH-VWFW: nodemailer Npm
Vulnerability summary
GHSA-FRJ6-5RHH-VWFW is a high (CVSS 8.3) vulnerability in nodemailer Npm.
Severe, CVSS 8.3 (OSV · Npm); no exploitation reported by the 5 checked sources; EPSS not yet published
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 1Timeline
- 31-08-2026PublishedVulnerability first disclosed.
- 05-10-2026Last modifiedVulnerability information updated.
Description
Duplicate Advisory: Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception ## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-r7g4-qg5f-qqm2. This link is maintained to preserve external references. ## Original Description Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitted over compromised HTTPS connections.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Npm1 product
- nodemailer≤ 8.0.7
1 vendor · 1 product
