GHSA-wqvq-jvpq-h66f

What it actually does

Nodemailer’s jsonTransport message normalization could bypass the intended disableFileAccess and disableUrlAccess protections. When applications relied on those options to prevent email content, attachments, or related message fields from being populated from local files or remote URLs, jsonTransport processing could still normalize message input in a way that accessed disallowed file or URL sources. The impact is an authorization/control bypass within mail message construction rather than direct remote code execution.

Why it matters to the business

Applications using Nodemailer with jsonTransport and relying on disableFileAccess or disableUrlAccess may unintentionally allow data to be read from local files or external network locations during email generation. This can lead to accidental disclosure of sensitive files, unexpected outbound network requests, policy bypass, and loss of trust in email-processing controls. The issue is moderate severity and is not currently listed as known exploited by CISA, but any service that accepts user-influenced email message definitions should treat it as a meaningful data-exposure risk.

How an attack unfolds

An attacker first needs a path to influence Nodemailer message options in an application that uses jsonTransport. They craft message content, attachment definitions, or related fields that reference a local file path or remote URL. The application may believe file and URL access are blocked because disableFileAccess and disableUrlAccess are enabled, but vulnerable Nodemailer versions fail to enforce those restrictions consistently during jsonTransport normalization. If successful, the mail-generation flow may read local file content or fetch attacker-controlled remote resources, potentially exposing sensitive data through the generated JSON message output, application logs, email-related downstream processing, or observable network callbacks.

How to fix it

Upgrade Nodemailer to version 8.0.9 or later. Specifically, for npm package nodemailer, use a fixed version of 8.0.9 or newer. After upgrading, rebuild and redeploy affected applications and ensure dependency lockfiles are updated so vulnerable versions are not reintroduced. As defense in depth, avoid passing untrusted input directly into Nodemailer message objects, validate and allowlist attachment/content sources, block unexpected outbound network access from mail-processing services, and keep disableFileAccess and disableUrlAccess enabled where file or URL loading is not explicitly required.

How to confirm the fix worked

Confirm that all deployed applications resolve nodemailer to 8.0.9 or later by checking package-lock.json, npm-shrinkwrap.json, yarn.lock, pnpm-lock.yaml, container images, and runtime dependency inventories. Run `npm ls nodemailer` or equivalent software composition analysis tooling in each affected codebase. Add or run regression tests that attempt to use jsonTransport with file-backed and URL-backed message fields while disableFileAccess and disableUrlAccess are enabled; the test should fail safely and not read files or fetch URLs. Verify egress controls and application logs show no unexpected outbound requests during mail preview or message normalization workflows.

Typical attack path

1. Identify an application feature that builds or previews email messages using Nodemailer jsonTransport.
2. Determine whether user-controlled input can reach message fields such as attachments, content references, or URL/file-backed properties.
3. Submit a crafted message payload that references a local file path or an external URL.
4. Rely on the vulnerable normalization behavior to bypass disableFileAccess or disableUrlAccess.
5. Retrieve exposed content from the application response, logs, generated JSON transport output, downstream email workflow, or observe callback requests to attacker-controlled infrastructure.

How to detect it

Investigate whether users could submit or modify email message definitions, templates, attachments, or preview requests that reached Nodemailer jsonTransport. Review application logs, API request logs, email-preview logs, and error logs for message payloads containing file paths, file URLs, internal service URLs, or attacker-controlled URLs. Examine outbound proxy, DNS, and firewall logs from application hosts for unexpected requests occurring during email generation or preview actions, especially to unfamiliar domains, localhost, link-local addresses, internal hostnames, or cloud metadata endpoints. Look for file-read errors or access attempts in application logs involving message attachments or content normalization. If centralized logs retain request bodies, search for Nodemailer-style attachment fields containing `path`, `href`, `content`, `raw`, `cid`, or URL/file references. Absence of a public exploit or KEV listing reduces likelihood but does not rule out targeted abuse where applications expose email-building functionality to untrusted users.

• disableFileAccess
• disableUrlAccess
• jsonTransport
• attachments
• href:
• path:
• file://
• http://169.254.169.254
• https://169.254.169.254
• http://localhost
• http://127.0.0.1
• http://[::1]
• /etc/passwd
• /etc/hosts
• C:\\Windows\\win.ini
• C:\\Windows\\System32\\drivers\\etc\\hosts
• ENOTFOUND
• ECONNREFUSED
• EACCES
• ENOENT

What your security team should do

• Inventory applications and services that include the npm package nodemailer, prioritizing internet-facing systems and features where users can influence email templates, attachments, previews, or message metadata.
• Upgrade nodemailer to 8.0.9 or later and redeploy all affected services.
• Search source code for jsonTransport usage combined with disableFileAccess or disableUrlAccess assumptions, and review whether untrusted input can reach Nodemailer message options.
• Add input validation and allowlists for any file paths, URLs, attachments, or template-controlled message fields used in email generation.
• Review network egress logs for mail-processing services for unexpected outbound HTTP, HTTPS, or internal metadata-service requests.
• Review application logs and generated email-preview artifacts for evidence of local file path references, URL-backed attachments, or errors indicating attempted file/URL access.
• Add automated dependency scanning to prevent vulnerable Nodemailer versions from being reintroduced.