CVE-2026-82659

Name of the Vulnerable Software and Affected Versions nodemailer versions prior to 9.0.1

Description Authenticated attackers can read arbitrary local files or perform server-side request forgery (SSRF) by exploiting a failure to apply the disableFileAccess and disableUrlAccess flags to the message-level raw option. While these flags are intended to sandbox untrusted input by preventing the reading of local files or fetching of URLs, the MailComposer.compile() function fails to pass these flags when constructing the root MIME node for a raw message.

An attacker can exploit this by providing a raw object containing a path property to read sensitive server files or an href property to make requests to internal or metadata endpoints. The fetched content is then included in the body of the outgoing message and delivered to a recipient chosen by the attacker. This issue affects all bundled transports, including SMTP, SES, sendmail, stream, and JSON.

Recommendations Update nodemailer to version 9.0.1 or later. As a temporary mitigation, avoid using the raw option when processing untrusted input if disableFileAccess or disableUrlAccess are required.