CVE-2026-82659: nodemailer before 9.0.1 File Read and SSRF via raw option
nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbitrary files or perform server-side request forgery by supplying path or href properties. Attackers can exploit this by crafting raw messages with file paths or URLs that bypass the intended sandbox, with fetched content delivered in the outgoing message to attacker-controlled recipients.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nodemailerto a version that resolves this vulnerability.Fixed in 9.0.1 - Configuration
Ensure disableFileAccess and disableUrlAccess flags are correctly enforced for the message-level raw option (the issue is that nodemailer before 9.0.1 fails to apply these flags to the raw option).
nodemailer raw option disableFileAccess and disableUrlAccess flags = must apply to message-level raw option
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using the npm nodemailer package before version 9.0.1 are affected when an authenticated party can supply or influence the message-level raw option, including its path or href properties.
What access does an attacker need?
The attacker needs authenticated access and the ability to craft a raw message containing a file path or URL. No user interaction is required.
What is the impact of successful exploitation?
An attacker can cause the server to read arbitrary files or make server-side requests. The retrieved content is included in an outgoing message sent to recipients controlled by the attacker.
How can exposure be reduced before updating?
Do not allow untrusted authenticated users to control the message-level raw option or its path and href properties. The disableFileAccess and disableUrlAccess flags do not protect this raw-option path in affected versions.