PT-2026-83725

CVE-2026-82660

Published

2026-06-15

Updated

2026-08-31

Description by

CVSS 3.1

5.4

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nodemailer versions prior to 8.0.9

Description Nodemailer fails to enforce the disableFileAccess and disableUrlAccess security options during message normalization when using jsonTransport. This occurs because the shared.resolveContent() function, which is called during serialization, does not check these access control flags. Consequently, an attacker who can control message content fields can bypass intended restrictions to read local files or trigger outbound HTTP(S) requests. This issue is also reachable when attachDataUrls is enabled, as it triggers a similar pre-resolution path via the convertDataImages() function.

Technical details include:

API Endpoints: The issue is triggered when createTransport() is configured with jsonTransport: true.
Vulnerable Parameters or Variables: Attackers can exploit this by supplying path or href values within message content fields, such as attachments or the text field.
Function Names: The vulnerability exists within the shared.resolveContent() function and is triggered during the mail.normalize() process.

Recommendations Update Nodemailer to version 8.0.9 or later. As a temporary workaround, avoid using jsonTransport or the attachDataUrls feature when processing messages with user-controlled content until the update is applied.

Exploitability

Exploit

Fix

Impacts

Researchers

Dungnhvhust

Sondt99

Vendors

Affected products

Weakness enumeration

CWE-862: Missing Authorization

Related identifiers