CVE-2026-82660
Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess
- State
- Published
- Severity
- 5.3 Medium
- Published
- Aug 31, 2026
- Updated
- Aug 31, 2026
- Reserved
- Aug 30, 2026
Description
Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, bypassing intended access controls.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 5.4 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N | VulnCheck |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
nodemailernodemailer |
|
References
- GitHub Security Advisory (GHSA-wqvq-jvpq-h66f)vendor-advisory
- VulnCheck Advisory: Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccessthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.