Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. (CVE-2026-82660)

The vulnerability identified as CVE-2026-82660 affects Nodemailer prior to version 8.0.9. It involves a failure to enforce the disableFileAccess and disableUrlAccess options during the normalization of messages in the jsonTransport component. This allows an attacker with low privileges to supply path or href values in message content fields that can be used to read local files or fetch external URLs, circumventing intended access controls. The CVSS 3.1 score is 5.4 (medium severity), reflecting the network attack vector, low complexity, required privileges, no user interaction, and limited confidentiality and integrity impact.

An attacker with privileges to send messages via Nodemailer jsonTransport can exploit this vulnerability to read local files or fetch URLs, potentially exposing sensitive information. The impact is limited to confidentiality and integrity, with no availability impact reported. The attack requires low complexity and privileges but no user interaction.

No explicit patch or remediation is confirmed in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using jsonTransport with untrusted input or disable the vulnerable options if possible.