GHSA-r7g4-qg5f-qqm2
MediumSummary
Nodemailer disables TLS certificate verification in its internal HTTPS fetch client by setting rejectUnauthorized: false in lib/fetch/index.js. This causes OAuth2 token requests to trust invalid or self-signed HTTPS certificates.
Risk Assessment
The organization risks interception of sensitive OAuth2 credentials by a man-in-the-middle attacker who can impersonate the server and steal access tokens.
Recommendation
Immediately update Nodemailer to a version that removes the rejectUnauthorized: false setting, or manually enable certificate verification in the HTTPS client configuration.
Original NVD description (English source)
### Summary Nodemailer disables TLS certificate verification in its internal HTTPS fetch client through the use of rejectUnauthorized: false inside lib/fetch/index.js. As a result, OAuth2 token requests trust invalid or self-signed HTTPS certificates and transmit sensitive OAuth credentials over co