Improper Certificate Validation Affecting org.webjars.npm:nodemailer package, versions [,8.0.8)
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JAVA-ORGWEBJARSNPM-17342525
- published16 Jun 2026
- disclosed15 Jun 2026
- creditVenukamatchi
Introduced: 15 Jun 2026
CVE NOT AVAILABLE CWE-295 (opens in a new tab)How to fix?
Upgrade org.webjars.npm:nodemailer to version 8.0.8 or higher.
Overview
org.webjars.npm:nodemailer is an Easy as cake e-mail sending from your Node.js applications
Affected versions of this package are vulnerable to Improper Certificate Validation due to the use of rejectUnauthorized: false in the internal HTTPS client, which disables TLS certificate verification during OAuth2 token retrieval. An attacker can intercept sensitive OAuth2 credentials and tokens by performing a machine-in-the-middle attack on the HTTPS connection.