CVE-2026-82659

nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbitrary files or perform server-side request forgery by supplying path or href properties. Attackers can exploit this by crafting raw messages with file paths or URLs that bypass the intended sandbox, with fetched content delivered in the outgoing message to attacker-controlled recipients.

nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbitrary files or perform server-side request forgery by supplying path or href properties. Attackers can exploit this by crafting raw messages with file paths or URLs that bypass the intended sandbox, with fetched content delivered in the outgoing message to attacker-controlled recipients.

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-p6gq-j5cr-w38f. This link is maintained to preserve external references.

Original Description

nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbitrary files or perform server-side request forgery by supplying path or href properties. Attackers can exploit this by crafting raw messages with file paths or URLs that bypass the intended sandbox, with fetched content delivered in the outgoing message to attacker-controlled recipients.

Message-level raw option bypasses disableFileAccess / disableUrlAccess, enabling arbitrary file read and full-response SSRF in the sent message

• Target: nodemailer/nodemailer, npm nodemailer v9.0.0 (HEAD 4e58450eb490e5097a74b2b2cce35a8d9e21856e)
• Verdict: CONFIRMED (local PoC, no network)

Summary

Nodemailer exposes disableFileAccess and disableUrlAccess so an application that passes untrusted message data to the library can forbid that data from reading local files or fetching URLs. Every attachment, alternative, html/text/watchHtml/amp and icalEvent content node honors these flags. The message-level raw option does not.

MailComposer.compile() builds the root MIME node for a raw message without threading the two flags, so a raw: { path: '/etc/passwd' } or raw: { href: 'http://169.254.169.254/…' } message is read / fetched anyway, and the file or HTTP-response bytes become the actual message that is sent by every transport (SMTP, SES, sendmail, stream, JSON). An actor whose input the application intended to sandbox therefore obtains arbitrary local-file disclosure and a full-response SSRF primitive, delivered to a recipient the same actor can choose.

This is the same vulnerability class as the already-published jsonTransport advisory GHSA-wqvq-jvpq-h66f, but a distinct code path (raw root node, not normalize()), and strictly higher impact: the jsonTransport bug only affected the locally-returned JSON, whereas this affects the delivered RFC822 message for all transports.

Affected component

• lib/mail-composer/index.js:34-35 — root cause:

  if (this.mail.raw) {
      this.message = new MimeNode('message/rfc822', { newline: this.mail.newline }).setRaw(this.mail.raw);
  }
  

  The MimeNode is constructed with only { newline }. Compare the sibling node builders _createMixed/_createAlternative/_createRelated/_createContentNode (lib/mail-composer/index.js:389-527), which all pass disableUrlAccess: this.mail.disableUrlAccess, disableFileAccess: this.mail.disableFileAccess.
• lib/mime-node/index.js:51-52 — the constructor derives this.disableFileAccess/ this.disableUrlAccess solely from its own options; children do not inherit a parent's flags (createChild/appendChild, lines 175-194, pass options through verbatim).
• lib/mime-node/index.js:812 — setRaw() content is resolved through this._getStream(this._raw).
• lib/mime-node/index.js:984-1010 — _getStream reads the file (fs.createReadStream, 995) or fetches the URL (nmfetch, 1009) only guarded by this.disableFileAccess/this.disableUrlAccess, which on the raw root node are false.
• Reached from the normal send flow at lib/mailer/index.js:188 (mail.message = new MailComposer(mail.data).compile()), so every transport is affected.

Reachability gate (hop-by-hop)

1. Source. Application calls transporter.sendMail({ raw: <userControlled> , to: <userControlled> }) with disableFileAccess: true and/or disableUrlAccess: true configured on the transporter (forced onto mail.data in lib/mailer/mail-message.js:36-40) or per message. This is the exact scenario the flags exist for — the same precondition under which GHSA-wqvq-jvpq-h66f was accepted.
2. Guard — the access flags. For attachments the flag is enforced: a node created by _createContentNode carries disableFileAccess, so _getStream throws EFILEACCESS. Bypass: the raw branch (compile():34-35) never sets the flag on its node, so this.disableFileAccess === false and the guard at mime-node:985 / :999 is skipped. There is no other validation between mail.raw and the read; raw content shapes ({path}, {href}, stream, string, buffer) are accepted as-is by setRaw/_getStream.
3. Sink. fs.createReadStream(content.path) (file disclosure) or nmfetch(content.href, …)…

nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbitrary files or perform server-side request forgery by supplying path or href properties. Attackers can exploit this by crafting raw messages with file paths or URLs that bypass the intended sandbox, with fetched content delivered in the outgoing message to attacker-controlled recipients.

nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbitrary files or perform server-side request forgery by supplying path or href properties. Attackers can exploit this by crafting raw messages with file paths or URLs that bypass the intended sandbox, with fetched content delivered in the outgoing message to attacker-controlled recipients.