Executive brief
Nodemailer is a popular email composition and transmission library used by many Node.js applications. The jsonTransport feature, which converts emails to JSON format, bypasses security controls (disableFileAccess and disableUrlAccess) that are meant to prevent reading local files or fetching remote URLs. An attacker controlling email content fields can force the library to read sensitive files from the server or make outbound HTTP requests, with the results embedded in the generated JSON output.
Technical details
This is a security control bypass vulnerability in Nodemailer's jsonTransport feature. The vulnerability exists because jsonTransport uses mail.normalize() to serialize messages, which calls shared.resolveContent() to process HTML, text, attachments, and other content fields. The resolveContent() function reads local files via fs.createReadStream() and fetches remote content via HTTP(S) without checking the disableFileAccess and disableUrlAccess security flags, despite these flags being copied into the message context. In contrast, the normal MIME streaming path enforces these checks in MimeNode._getStream(). An attacker who can control message fields (attachment paths, text.href, etc.) can exploit this to read arbitrary local files or trigger outbound HTTP requests. The same bypass also affects the attachDataUrls feature when enabled. Patches are available in version 8.0.9.
Affected products
- Nodemailer Nodemailer <=8.0.8
Timeline
- 2026-06-15: disclosed
- 2026-06-15: patched: Version 8.0.9 contains the fix