CVE-2026-82659
nodemailer before 9.0.1 File Read and SSRF via raw option
- State
- Published
- Severity
- 7.1 High
- Published
- Aug 31, 2026
- Updated
- Aug 31, 2026
- Reserved
- Aug 30, 2026
Description
nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbitrary files or perform server-side request forgery by supplying path or href properties. Attackers can exploit this by crafting raw messages with file paths or URLs that bypass the intended sandbox, with fetched content delivered in the outgoing message to attacker-controlled recipients.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.1 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N | VulnCheck |
Weaknesses
- CWE-73 External Control of File Name or Path
Affected Products
| Product | Versions |
|---|---|
nodemailernodemailer |
|
References
- GitHub Security Advisory (GHSA-p6gq-j5cr-w38f)vendor-advisory
- VulnCheck Advisory: nodemailer before 9.0.1 File Read and SSRF via raw optionthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.