CVE-2026-82660: Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess
Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, bypassing intended access controls.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nodemailerto a version that resolves this vulnerability.Fixed in 8.0.9 - Configuration
Upgrade to nodemailer 8.0.9 or later where jsonTransport properly enforces the disableFileAccess option during message normalization.
Nodemailer jsonTransport disableFileAccess = enforced - Configuration
Upgrade to nodemailer 8.0.9 or later where jsonTransport properly enforces the disableUrlAccess option during message normalization.
Nodemailer jsonTransport disableUrlAccess = enforced
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using Nodemailer jsonTransport are affected if they use a version before 8.0.9 and rely on disableFileAccess or disableUrlAccess to prevent message content from accessing local files or URLs.
What does an attacker need to exploit this?
An attacker needs the ability to supply path or href values in message content fields processed by jsonTransport. No user interaction is required.
What can be done if upgrading is not immediately possible?
Do not allow untrusted input to populate path or href values in message content fields handled by jsonTransport. Treat disableFileAccess and disableUrlAccess as ineffective for this transport until the issue is remediated.