Nodemailer CVE-2026-82660

Exploitation requires three concurrent conditions: (1) the application must use createTransport({ jsonTransport: true }) - applications using SMTP, SES, or other transports are not affected by this code path; (2) the application must set disableFileAccess and/or disableUrlAccess as an intended security control - applications that never set those flags have no broken security boundary to exploit; and (3) the attacker must be able to supply or influence message content fields processed by normalize(), including attachment path, html.href, text.href, watchHtml, amp, icalEvent content, or alternatives entries. The CVSS 4.0 PR:L metric confirms that some authenticated or authorized access to the application is required before content can be injected - unauthenticated remote exploitation of default configurations is not supported by the available data. The secondary path via attachDataUrls requires that option to also be enabled. What limits exploitation: non-default transport selection (jsonTransport), deliberate use of the now-ineffective access-control flags, and at least low-level application access.

The CVSS 4.0 score of 5.3 (Medium) with AV:N/AC:L/AT:N/PR:L/UI:N reflects a network-exploitable flaw gated behind low privileges - meaning the attacker must already be able to supply or influence Nodemailer message content fields such as attachment path, html.href, or text.href. In practice this is easily satisfied in multi-tenant SaaS platforms, queue-based email pipelines, or any application that accepts user-influenced email content destined for jsonTransport serialization. The VC:L/VI:L impact ratings indicate limited per-exploitation impact: file reads are bounded by the Node.js process's filesystem permissions, and URL fetches produce outbound requests rather than direct return of arbitrary data. However, chained with SSRF against cloud metadata endpoints or internal services, or used to leak sensitive configuration files containing credentials or API keys, real-world impact can materially exceed what the CVSS base score alone implies. No EPSS data was provided in the source input, so probabilistic exploitation likelihood cannot be independently quantified. The CVE is not in CISA KEV and no public exploit code is referenced in the provided sources, suggesting no confirmed active exploitation at time of analysis. Risk is most acute for applications that explicitly set disableFileAccess or disableUrlAccess believing those flags create a security boundary - those deployments are misconfigured in a silent and non-obvious way.

An attacker with access to a multi-tenant application's email composition API submits a crafted payload setting an attachment path to a sensitive local file such as /proc/self/environ or a cloud credential file, or sets text.href to an internal AWS metadata endpoint. When the backend calls sendMail() using jsonTransport to serialize the message for a queue, shared.resolveContent() reads the file or fetches the URL without checking disableFileAccess or disableUrlAccess, and the resulting JSON output - returned to the attacker or logged - contains the retrieved content. No public exploit code has been identified, but the vulnerability mechanics and source-to-sink evidence are fully detailed in GHSA-wqvq-jvpq-h66f, making independent reproduction straightforward.