GHSA-p6gq-j5cr-w38f

What it actually does

Nodemailer versions before 9.0.1 allow the message-level raw option to bypass protections intended to prevent local file access and URL fetching, specifically disableFileAccess and disableUrlAccess. If an application lets untrusted or partially trusted users influence email message construction, an attacker can craft a raw MIME message that causes Nodemailer to read arbitrary local files or fetch attacker-chosen URLs while composing or delivering the email. The resulting file contents or HTTP response body can be embedded into the delivered message, making this both an arbitrary file read issue and a full-response server-side request forgery flaw.

Why it matters to the business

Applications that use vulnerable Nodemailer versions for user-driven email generation may leak sensitive files, configuration secrets, tokens, internal service responses, or cloud metadata through outbound emails. This can lead to credential theft, exposure of private business data, compromise of connected systems, and abuse of internal network trust. Although this advisory is not listed in CISA KEV and no mature public exploit is noted, the affected package is commonly used in Node.js applications, so organizations should prioritize upgrades wherever email content can be influenced by users or external data.

How an attack unfolds

An attacker first identifies an application feature that sends email using Nodemailer, such as contact forms, invitations, support workflows, report delivery, passwordless login messages, or notification templates. The attacker then supplies input that is incorporated into the Nodemailer message object, specifically attempting to influence the raw message-level option. In vulnerable versions, even when the application or transport configuration sets disableFileAccess or disableUrlAccess, the raw message path can still reference local files or URLs. Nodemailer processes those references while building the message, reads the local file or performs the HTTP request from the server side, and embeds the retrieved content into the email. The attacker receives the email or causes it to be sent to an address they control, giving them the contents of the targeted file or the full response from an internal or external URL.

How to fix it

Upgrade Nodemailer to version 9.0.1 or later. Treat this as the primary fix because the vulnerable behavior is in Nodemailer’s message processing. Review all code paths that construct Nodemailer messages and ensure untrusted input cannot set or influence the raw option, attachment paths, href values, or other file/URL-loading fields. Continue using disableFileAccess and disableUrlAccess where appropriate, but do not rely on them as a substitute for upgrading. Validate email templates and message objects against an allowlist of permitted fields, strip raw MIME input from user-controlled workflows, and restrict outbound network access from application servers to reduce SSRF impact. If sensitive local files or internal metadata services may have been reachable, rotate potentially exposed credentials after investigation.

How to confirm the fix worked

Confirm that dependency manifests and deployed artifacts resolve nodemailer to 9.0.1 or later, including transitive or bundled copies. Run package-manager checks such as npm ls nodemailer, npm audit, or software composition analysis against built containers and production deployment images. Review application code for createTransport and sendMail usage and verify that user-controlled data cannot populate the raw option. Test representative email-sending workflows with benign file and URL reference payloads to confirm that local file reads and URL fetches are blocked or sanitized and that no fetched content appears in delivered messages. Validate egress controls by confirming the application cannot reach cloud metadata endpoints, loopback-only administrative services, or unauthorized internal HTTP services.

Typical attack path

1. Find an externally reachable workflow that sends email through a Node.js application using Nodemailer.
2. Determine whether user-controlled input can influence message fields, templates, attachments, or raw MIME content.
3. Inject or submit a crafted message-level raw payload that references a local file or attacker-selected URL.
4. Rely on the vulnerable bypass so disableFileAccess and disableUrlAccess do not block the file read or URL fetch.
5. Receive the generated email containing the local file contents or server-side HTTP response.
6. Use exposed secrets, configuration data, internal API responses, or metadata credentials for further compromise.

How to detect it

Investigate both application-layer request logs and outbound email artifacts. Review web access logs, API logs, and application logs for attempts to submit raw MIME content, file URL references, local filesystem paths, localhost URLs, internal IP ranges, or cloud metadata endpoints through email-sending workflows. Examine Nodemailer debug logs, if enabled, for unexpected file reads or URL fetches during message generation. Inspect SMTP gateway logs, mail transfer agent logs, and message archives for outbound emails to unusual recipients that contain contents resembling system files, environment variables, cloud metadata JSON, internal service banners, or HTTP responses. Network telemetry and proxy logs should be searched for Node.js application hosts making unexpected HTTP requests to 127.0.0.1, localhost, link-local metadata addresses, RFC1918 addresses, or attacker-controlled domains shortly before email delivery. If exploitation is suspected, correlate the triggering web request, the server-side outbound HTTP request or file access, and the resulting outbound email.

• raw
• disableFileAccess
• disableUrlAccess
• file://
• /etc/passwd
• /etc/hosts
• /proc/self/environ
• /proc/self/cmdline
• /var/run/secrets/kubernetes.io/serviceaccount/token
• http://169.254.169.254
• http://metadata.google.internal
• http://metadata/computeMetadata/v1/
• http://127.0.0.1
• http://localhost
• http://[::1]
• X-aws-ec2-metadata-token
• latest/meta-data/
• iam/security-credentials/
• BEGIN RSA PRIVATE KEY
• BEGIN OPENSSH PRIVATE KEY
• AWS_ACCESS_KEY_ID
• AWS_SECRET_ACCESS_KEY

What your security team should do

• Upgrade all affected Nodemailer installations to 9.0.1 or later, prioritizing internet-facing applications and workflows where users can influence email content.
• Search application repositories for Nodemailer sendMail usage and remove or strictly gate any use of the message-level raw option.
• Audit email-generation features such as contact forms, support tickets, notification systems, and report delivery for user-controlled MIME, attachment, path, or URL fields.
• Add outbound network restrictions for Node.js application runtimes, especially blocking access to cloud metadata IPs, localhost administration ports, and unnecessary internal services.
• Review delivered-email logs and mail archives for suspicious messages containing local file contents, metadata service responses, environment data, or internal HTTP responses.
• Rotate credentials if investigation finds evidence that configuration files, environment files, cloud metadata, SSH keys, API tokens, or service account material may have been emailed.
• Add regression tests that attempt file and URL inclusion through raw message input and fail builds if fetched content appears in generated messages.