CVE-2026-82659

What it actually does

Nodemailer versions before 9.0.1 do not enforce the disableFileAccess and disableUrlAccess sandbox flags on the message-level raw option. An authenticated caller who can influence raw message construction can cause the mailer to read local filesystem paths or fetch remote URLs via path or href properties; retrieved content is then embedded in the outgoing message. The result is authenticated local file disclosure and server-side request forgery (SSRF) from the mail-sending process, with confidentiality impact high and limited integrity impact as reflected in CVSS 7.1.

Why it matters to the business

Applications that let authenticated users trigger or shape outbound mail can leak secrets, configuration, and other files from the mail host, or coerce the host into requesting internal HTTP services, with the stolen material leaving the environment as ordinary email. This is not listed in CISA KEV and has no reported ransomware use or known exploit maturity about a month after publication, so mass opportunistic exploitation is not indicated; residual risk remains wherever untrusted content reaches the raw option, especially in products that embed nodemailer widely as a mail dependency.

How an attack unfolds

An attacker who already has a legitimate or stolen application account finds a feature that sends mail through nodemailer and that accepts attacker-influenced raw message content. They submit a raw message that references a local path or a URL, counting on disableFileAccess and disableUrlAccess not being applied on that code path. The library reads the file or performs the request in the server's security context, then includes the fetched body in the outbound message delivered to an address the attacker controls. No unauthenticated remote code execution is implied; abuse depends on authenticated access plus a reachable raw-message input.

How to fix it

Upgrade nodemailer to 9.0.1 or later so disableFileAccess and disableUrlAccess apply to the message-level raw option. Until every runtime is upgraded, do not pass untrusted or user-influenced content into raw; construct messages only through the supported structured fields. Keep disableFileAccess and disableUrlAccess enabled, restrict which identities can send mail, and limit the mailer process's filesystem and egress permissions so a missed flag cannot reach secrets or internal services. Rebuild and redeploy all services that vendor or bundle nodemailer, including transitive installs.

How to confirm the fix worked

Inventory lockfiles and container images for nodemailer versions older than 9.0.1 and confirm the resolved version after upgrade. In a non-production check, send mail through the same code paths that set disableFileAccess and disableUrlAccess and use the raw option, and verify that local path and URL references are rejected rather than inlined. Confirm the mailer process cannot read sensitive files or reach internal URLs even if a raw payload is submitted. Review application code and templates for any remaining user-controlled raw usage.

Typical attack path

1. Obtain authenticated access to an application that sends mail with nodemailer
2. Identify a workflow that accepts or concatenates attacker-controlled content into the message-level raw option
3. Submit a raw message that references a local file path or an internal or attacker-chosen URL despite sandbox flags being set
4. Wait for nodemailer to read the path or fetch the URL on the server
5. Receive the outgoing message at an attacker-controlled recipient and extract the embedded file or HTTP response content

How to detect it

There are no public in-the-wild campaigns, named threat actors, or KEV listings for this issue, so hunting is for possible historical abuse rather than a known malware family. Review application and SMTP logs around mail-send APIs for authenticated users who supplied raw message bodies containing file or URL references, and correlate with unexpectedly large or sensitive outbound messages. On hosts running the mailer, look for the Node process reading unusual local files or making HTTP requests to internal or metadata endpoints at send time. Inspect stored sent-mail copies or journal archives for messages whose bodies resemble local config files, keys, or internal HTTP responses delivered to unusual recipients.

What your security team should do

• Patch or bump nodemailer to 9.0.1+ across all services and lockfiles as the primary fix
• Block or sanitize user-influenced raw message input until every instance is upgraded
• Run dependency and image scans for nodemailer < 9.0.1 and fail builds that still pull the vulnerable range
• Tighten the mailer runtime's filesystem and outbound network permissions as defense in depth
• Hunt for historical mail-send activity that may have inlined unexpected file or URL content, even though no in-the-wild campaign is reported