PT-2026-83725 · Npm · Nodemailer
CVSS v3.1
5.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Nodemailer versions prior to 8.0.9
Description
Nodemailer fails to enforce the
disableFileAccess and disableUrlAccess security options during message normalization when using jsonTransport. This occurs because the shared.resolveContent() function, which is called during serialization, does not check these access control flags. Consequently, an attacker who can control message content fields can bypass intended restrictions to read local files or trigger outbound HTTP(S) requests. This issue is also reachable when attachDataUrls is enabled, as it triggers a similar pre-resolution path via the convertDataImages() function.Technical details include:
- API Endpoints: The issue is triggered when
createTransport()is configured withjsonTransport: true. - Vulnerable Parameters or Variables: Attackers can exploit this by supplying
pathorhrefvalues within message content fields, such as attachments or thetextfield. - Function Names: The vulnerability exists within the
shared.resolveContent()function and is triggered during themail.normalize()process.
Recommendations
Update Nodemailer to version 8.0.9 or later.
As a temporary workaround, avoid using
jsonTransport or the attachDataUrls feature when processing messages with user-controlled content until the update is applied.Exploit
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Nodemailer