Quick answers
- Is CVE-2026-82660 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-82660 being exploited in the wild.
- How severe is CVE-2026-82660?
- Medium severity, with a CVSS score of 5.4, published 31 August 2026.
- Which products and versions are affected?
- Nodemailer <=8.0.8.
- Is there a fix for CVE-2026-82660?
- A patch was published on 2026-06-15: Version 8.0.9 contains the fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-82660 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-82660?
- Check whether you run Nodemailer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a security control bypass vulnerability in Nodemailer's jsonTransport feature. The vulnerability exists because jsonTransport uses mail.normalize() to serialize messages, which calls shared.resolveContent() to process HTML, text, attachments, and other content fields. The resolveContent() function reads local files via fs.createReadStream() and fetches remote content via HTTP(S) without checking the disableFileAccess and disableUrlAccess security flags, despite these flags being copied into the message context. In contrast, the normal MIME streaming path enforces these checks in MimeNode._getStream(). An attacker who can control message fields (attachment paths, text.href, etc.) can exploit this to read arbitrary local files or trigger outbound HTTP requests. The same bypass also affects the attachDataUrls feature when enabled. Patches are available in version 8.0.9.
Affected products
- Nodemailer Nodemailer <=8.0.8
Identifiers
- CVE-2026-82660
- GHSA-wqvq-jvpq-h66f
Timeline
- 2026-06-15: disclosed
- 2026-06-15: patched: Version 8.0.9 contains the fix