nodemailer CVE-2026-82659

Exploitation requires all of the following: (1) the target application uses nodemailer version 9.0.0 or earlier; (2) the application has set disableFileAccess: true or disableUrlAccess: true on the nodemailer transport or message options to sandbox untrusted input; (3) an attacker-controlled value can reach the message-level raw option - specifically an object with a path property (for file read) or an href property (for SSRF); and (4) the attacker has authenticated access to trigger the email-sending code path. Exploitation is strictly bounded to arbitrary local file read and full-response SSRF delivered in the outgoing message - no remote code execution is possible. Applications that do not expose the raw option to untrusted callers, do not rely on the sandbox flags for security enforcement, or validate the raw option's shape before passing it to nodemailer are not exploitable.

The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N) signals a network-accessible, low-complexity, low-privilege flaw with high confidentiality impact. Real-world exploitability is conditional: the application must (1) use nodemailer <= 9.0.0, (2) have set disableFileAccess or disableUrlAccess to enforce a sandbox on untrusted user content, and (3) allow attacker-controlled data to reach the raw message option. Applications that do not expose raw to untrusted callers are unaffected. No EPSS score was provided, and the vulnerability is absent from CISA KEV, suggesting no observed mass exploitation at time of analysis. However, a local PoC is confirmed by the GHSA advisory, and the attack pattern is straightforward, lowering the practical barrier. Given nodemailer's enormous deployment footprint, any application relying on the sandbox flags for multi-tenant or user-generated-content scenarios faces meaningful risk and should treat patching as urgent.

An authenticated user of a multi-tenant email platform supplies a crafted message body with raw: { path: '/etc/passwd' } or raw: { href: 'http://169.254.169.254/latest/meta-data/iam/security-credentials/' } to the application's email API. The application passes this to nodemailer with disableFileAccess: true and disableUrlAccess: true set, expecting the sandbox to block the read - but the raw MimeNode is built without these flags, so nodemailer fetches the file or URL and delivers its full contents as the email body to the attacker's own mailbox. A local PoC confirming this behavior is referenced in GHSA-p6gq-j5cr-w38f.