The vulnerability in Nodemailer allows TLS certificate verification to be disabled, enabling an attacker in a man‑in‑the‑middle position to intercept OAuth2 traffic. By setting rejectUnauthorized to false, the library accepts any server certificate, allowing the capture of OAuth client secrets, refresh tokens and access tokens exchanged over HTTPS. This results in the theft of sensitive credentials that can be used to impersonate legitimate services and gain unauthorized access.

Nodemailer versions prior to 8.0.8 are affected. Any project using the nodemailer library before this version is potentially vulnerable.

The CVSS score of 8.3 classifies this flaw as high severity. EPSS scores are currently unavailable, and the vulnerability is not listed in CISA KEV. The likely attack vector is a network‑level MITM, which can be carried out against any node using the vulnerable library to transmit OAuth traffic. Given the high score and the clear credential exposure, the risk is significant for applications that rely on OAuth for authentication.