CVE-2026-82660

Name of the Vulnerable Software and Affected Versions Nodemailer versions prior to 8.0.9

Description Nodemailer fails to enforce the disableFileAccess and disableUrlAccess security options during message normalization when using jsonTransport. This occurs because the shared.resolveContent() function, which is called during serialization, does not check these access control flags. Consequently, an attacker who can control message content fields can bypass intended restrictions to read local files or trigger outbound HTTP(S) requests. This issue is also reachable when attachDataUrls is enabled, as it triggers a similar pre-resolution path via the convertDataImages() function.

Technical details include:

Recommendations Update Nodemailer to version 8.0.9 or later. As a temporary workaround, avoid using jsonTransport or the attachDataUrls feature when processing messages with user-controlled content until the update is applied.