Skip to main content

Nodemailer CVE-2026-82660

| EUVDEUVD-2026-68438 MEDIUM
Missing Authorization (CWE-862)
2026-08-31 VulnCheck GHSA-28mw-fm9r-fxjg
Authentication Bypass Nodemailer Red Hat Suse
5.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
5.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.4 MEDIUM

Network-reachable via user-controlled content fields; low privileges required to inject malicious paths; confidentiality and integrity impacts are limited and bounded by process permissions.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE
5.4 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Red Hat
5.4 MEDIUM
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

4
CVE Published
Aug 31, 2026 - 10:50 cve.org
MEDIUM 5.3
Patch available
Aug 31, 2026 - 10:16 EUVD
Source Code Evidence Fetched
Aug 31, 2026 - 09:36 vuln.today
Analysis Generated
Aug 31, 2026 - 09:36 vuln.today

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 10 npm packages depend on nodemailer (8 direct, 3 indirect)

Ecosystem-wide dependent count for version 8.0.9.

DescriptionCVE.org

Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, bypassing intended access controls.

AnalysisAI

Nodemailer's jsonTransport transport fails to enforce disableFileAccess and disableUrlAccess controls during message normalization in all versions prior to 8.0.9, allowing attackers with control over message content fields to read local filesystem content or trigger outbound SSRF-style HTTP requests. Applications that use jsonTransport as a safe serializer or queue payload generator while trusting those access-control options as a security boundary are the primary affected population. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires three concurrent conditions: (1) the application must use createTransport({ jsonTransport: true }) - applications using SMTP, SES, or other transports are not affected by this code path; (2) the application must set disableFileAccess and/or disableUrlAccess as an intended security control - applications that never set those flags have no broken security boundary to exploit; and (3) the attacker must be able to supply or influence message content fields processed by normalize(), including attachment path, html.href, text.href, watchHtml, amp, icalEvent content, or alternatives entries. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 5.3 (Medium) with AV:N/AC:L/AT:N/PR:L/UI:N reflects a network-exploitable flaw gated behind low privileges - meaning the attacker must already be able to supply or influence Nodemailer message content fields such as attachment path, html.href, or text.href. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Vendor-released patch: 8.0.9. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Nodemailer

View all
CVE-2020-7769 CRITICAL POC
9.8 Nov 12

This affects the package nodemailer before 6.4.16. Rated critical severity (CVSS 9.8), this vulnerability is remotely ex
CVE-2021-23400 HIGH POC
8.8 Jun 29

The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain n
CVE-2026-82854 CRITICAL
9.3 Aug 31

SMTP command injection in Nodemailer before 8.0.4 lets attackers smuggle arbitrary SMTP verbs (notably RCPT TO) into out
CVE-2026-82662 HIGH
8.3 Aug 31

TLS certificate verification is disabled by hardcoded `rejectUnauthorized: false` in Nodemailer's internal HTTPS fetch c
CVE-2026-82659 HIGH POC
7.1 Aug 31

Sandbox bypass in nodemailer <= 9.0.0 exposes arbitrary file read and full-response SSRF to any authenticated applicatio
CVE-2026-82853 MEDIUM
6.9 Aug 31

SMTP command injection in Nodemailer (npm) versions up to and including 8.0.4 allows an attacker who can influence the t
CVE-2026-82661 MEDIUM
5.3 Aug 31

CRLF injection in Nodemailer's List-* header construction allows any application-level user with control over list comme

Same weakness CWE-862 – Missing Authorization

View all
CVE-2023-52163 HIGH POC
8.8
CVE-2025-6205 CRITICAL POC
9.1
CVE-2025-20362 HIGH POC
8.6
CVE-2017-9232 CRITICAL POC
9.8
CVE-2023-6875 CRITICAL POC
9.8
CVE-2024-4898 CRITICAL POC
9.8
CVE-2023-32117 CRITICAL POC
9.8
CVE-2020-36719 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected
SUSE Linux Enterprise Micro 5.5 Not-Affected

Share

CVE-2026-82660 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy