Skip to main content

nodemailer EUVDEUVD-2026-68437

| CVE-2026-82659 HIGH
External Control of File Name or Path (CWE-73)
2026-08-31 VulnCheck GHSA-h3hj-cmcx-xc66 GHSA-p6gq-j5cr-w38f
SSRF Nodemailer Red Hat Suse
7.1
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
7.1 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.1 HIGH

Network-reachable with low privilege required (authenticated application user); high confidentiality impact from arbitrary file read, low integrity impact from SSRF; no scope change as subsequent systems receive data rather than being compromised.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.1 HIGH
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

5
POC Analysis Generated
Sep 02, 2026 - 19:20 vuln.today
CVE Published
Aug 31, 2026 - 10:50 cve.org
HIGH 7.1
Patch available
Aug 31, 2026 - 10:16 EUVD
Source Code Evidence Fetched
Aug 31, 2026 - 09:29 vuln.today
Analysis Generated
Aug 31, 2026 - 09:29 vuln.today

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 67 npm packages depend on nodemailer (31 direct, 38 indirect)

Ecosystem-wide dependent count for version 9.0.1.

DescriptionCVE.org

nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbitrary files or perform server-side request forgery by supplying path or href properties. Attackers can exploit this by crafting raw messages with file paths or URLs that bypass the intended sandbox, with fetched content delivered in the outgoing message to attacker-controlled recipients.

AnalysisAI

Sandbox bypass in nodemailer <= 9.0.0 exposes arbitrary file read and full-response SSRF to any authenticated application user whose input reaches the message-level raw option. The disableFileAccess and disableUrlAccess flags - intended to sandbox untrusted message data - are correctly threaded through all other content node builders but are silently omitted when a MimeNode is constructed for a raw message in lib/mail-composer/index.js:34-35, leaving the raw path completely unrestricted. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires all of the following: (1) the target application uses nodemailer version 9.0.0 or earlier; (2) the application has set `disableFileAccess: true` or `disableUrlAccess: true` on the nodemailer transport or message options to sandbox untrusted input; (3) an attacker-controlled value can reach the message-level `raw` option - specifically an object with a `path` property (for file read) or an `href` property (for SSRF); and (4) the attacker has authenticated access to trigger the email-sending code path. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N) signals a network-accessible, low-complexity, low-privilege flaw with high confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Vendor-released patch: 9.0.1. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Nodemailer

View all
CVE-2020-7769 CRITICAL POC
9.8 Nov 12

This affects the package nodemailer before 6.4.16. Rated critical severity (CVSS 9.8), this vulnerability is remotely ex
CVE-2021-23400 HIGH POC
8.8 Jun 29

The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain n
CVE-2026-82854 CRITICAL
9.3 Aug 31

SMTP command injection in Nodemailer before 8.0.4 lets attackers smuggle arbitrary SMTP verbs (notably RCPT TO) into out
CVE-2026-82662 HIGH
8.3 Aug 31

TLS certificate verification is disabled by hardcoded `rejectUnauthorized: false` in Nodemailer's internal HTTPS fetch c
CVE-2026-82853 MEDIUM
6.9 Aug 31

SMTP command injection in Nodemailer (npm) versions up to and including 8.0.4 allows an attacker who can influence the t
CVE-2026-82661 MEDIUM
5.3 Aug 31

CRLF injection in Nodemailer's List-* header construction allows any application-level user with control over list comme
CVE-2026-82660 MEDIUM
5.3 Aug 31

Nodemailer's jsonTransport transport fails to enforce disableFileAccess and disableUrlAccess controls during message nor

Same weakness CWE-73 – External Control of File Name or Path

View all
CVE-2025-33053 HIGH POC
8.8
CVE-2023-4634 CRITICAL POC
9.8
CVE-2025-24054 MEDIUM POC
6.5
CVE-2025-0111 HIGH
7.1
CVE-2024-8517 CRITICAL POC
9.8
CVE-2024-55372 CRITICAL POC
9.8
CVE-2026-18048 HIGH POC
7.5
CVE-2024-55371 CRITICAL POC
9.8

Same technique SSRF

View all
CVE-2021-34473 CRITICAL POC
9.1
CVE-2021-26855 CRITICAL POC
9.1
CVE-2021-21985 CRITICAL POC
9.8
CVE-2024-21893 HIGH POC
8.2
CVE-2021-40438 CRITICAL POC
9.0
CVE-2021-21975 HIGH POC
7.5
CVE-2016-3718 MEDIUM POC
5.5
CVE-2026-15409 CRITICAL POC
10.0

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected
SUSE Linux Enterprise Micro 5.5 Not-Affected

Share

EUVD-2026-68437 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy