CVE-2026-82660 in Nodemailer
Summary
by MITRE • 08/31/2026
Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, bypassing intended access controls.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/31/2026
The vulnerability identified in Nodemailer versions prior to 8.0.9 represents a critical failure in input validation and security control enforcement within the jsonTransport module. This transport mechanism is designed for serializing email messages into JSON format rather than sending them over SMTP, often used in server-side applications where emails are queued or processed asynchronously. The core issue lies in how message content fields are normalized before serialization. Specifically, the library fails to enforce the disableFileAccess and disableUrlAccess configuration options during this normalization phase. These security features are intended to prevent email clients from automatically downloading external resources such as images hosted on remote servers or accessing local files embedded via file:// protocols, which is a common vector for cross-site scripting (XSS) attacks, clickjacking, and sensitive data exfiltration in modern web applications that render HTML emails.
From a technical perspective, the flaw stems from an incomplete implementation of security filters during the message processing pipeline. When a user supplies path values or href attributes within the email content fields, such as img tags with src attributes pointing to local file paths or remote URLs, Nodemailer processes these inputs without adequately stripping them out when the disableFileAccess and disableUrlAccess flags are set to true. This bypass allows attackers who have control over the input data for an email message to inject malicious links or references. In environments where HTML emails are rendered in web-based interfaces using untrusted content sanitization libraries, this can lead to severe security consequences including remote code execution if combined with other vulnerabilities, or more commonly, privacy violations and session hijacking through tracking pixels or credential harvesting via phishing pages hosted on attacker-controlled domains.
The operational impact of this vulnerability is significant for applications that rely on Nodemailer for generating dynamic email content where user input influences the message body. Attackers can exploit this to read local files from the server if file access is not properly disabled, potentially exposing sensitive configuration files or internal data structures depending on the context in which the email client renders the content. Furthermore, fetching URLs allows attackers to track recipients by loading remote images that send HTTP requests containing cookie information or other identifying headers back to a controlled server. This facilitates user tracking and profiling without consent. In more advanced attack scenarios involving web-based email clients with insufficient sanitization policies, this vulnerability can serve as an entry point for stored cross-site scripting attacks if the rendered HTML is not properly escaped before display in a browser context.
This issue aligns closely with CWE-918, which covers Server-Side Request Forgery (SSRF) flaws where server-side code makes requests to URLs provided by users without sufficient validation. It also relates to CWE-749, Exposed Dangerous Method or Function, as the library exposes functionality that can be misused due to improper configuration enforcement. In terms of MITRE ATT&CK framework mapping, this vulnerability facilitates techniques associated with T1059 Command and Scripting Interpreter if combined with other vectors for code execution, but more directly it supports reconnaissance activities such as T1071 Application Layer Protocol for data exfiltration through HTTP requests triggered by image loading. The lack of enforcement on security options constitutes a configuration-based weakness that attackers can exploit without needing to bypass complex authentication or encryption mechanisms.
To mitigate this vulnerability, organizations using Nodemailer must immediately upgrade to version 8.0.9 or later where the normalization process correctly respects and enforces disableFileAccess and disableUrlAccess settings. For applications unable to update promptly due to dependency constraints, a temporary workaround involves implementing custom sanitization logic on all user-supplied content before passing it to Nodemailer. This includes stripping out any img tags with src attributes pointing to file:// protocols or external domains when such access is not required by the application's business logic. Additionally, developers should ensure that HTML emails are rendered using robust Content Security Policy (CSP) headers and dedicated email sanitization libraries like DOMPurify configured for strict mode in web interfaces displaying these messages. Regular security audits of email generation pipelines and dependency updates through automated tools such as Snyk or Dependabot can help prevent similar issues arising from outdated library versions with known weaknesses in input handling and access control enforcement.