nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to… (CVE-2026-82659)

The vulnerability in nodemailer prior to version 9.0.1 involves failure to enforce disableFileAccess and disableUrlAccess flags on the message-level raw option. Authenticated attackers can exploit this by crafting raw email messages containing file paths or URLs that bypass sandbox restrictions, enabling arbitrary file reads or server-side request forgery (SSRF). The attacker can receive the fetched content in outgoing emails, potentially exposing sensitive data or enabling further attacks.

Successful exploitation allows an authenticated attacker to read arbitrary files on the server or perform SSRF attacks, potentially exposing sensitive information. The CVSS score of 7.1 (high) reflects the network attack vector with low attack complexity and no user interaction required. Confidentiality is highly impacted, while integrity is slightly impacted and availability is unaffected.

A fix is available in nodemailer version 9.0.1 that properly applies the disableFileAccess and disableUrlAccess flags to the message-level raw option. Users should upgrade to version 9.0.1 or later to remediate this vulnerability. No other mitigation steps are indicated by the vendor advisory.