CVE-2026-82659
nodemailer before 9.0.1 File Read and SSRF via raw option
CVSS Score
7.1
EPSS Score
0.0%
EPSS Percentile
0th
nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbitrary files or perform server-side request forgery by supplying path or href properties. Attackers can exploit this by crafting raw messages with file paths or URLs that bypass the intended sandbox, with fetched content delivered in the outgoing message to attacker-controlled recipients.
| CWE | CWE-73 |
| Vendor | nodemailer |
| Product | nodemailer |
| Published | Aug 31, 2026 |
Stay Ahead of the Next One
Get instant alerts for nodemailer nodemailer
Be the first to know when new high vulnerabilities affecting nodemailer nodemailer are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
None
Affected Versions
nodemailer / nodemailer
0 < 9.0.1
References
Credits
🔍 Pig-Tail