# CVE-2026-82660: Nodemailer jsonTransport security control bypass in content resolution

Source: https://junglewise.ai/threats/cve-2026-82660-nodemailer-jsontransport-security-control-bypass-in-content  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82660 · Severity: medium · CVSS 5.4 · Published 2026-08-31

Nodemailer is a popular email composition and transmission library used by many Node.js applications. The jsonTransport feature, which converts emails to JSON format, bypasses security controls (disableFileAccess and disableUrlAccess) that are meant to prevent reading local files or fetching remote URLs. An attacker controlling email content fields can force the library to read sensitive files from the server or make outbound HTTP requests, with the results embedded in the generated JSON output.

Technologies: [Nodemailer](https://junglewise.ai/threats/technologies/nodemailer). Vendors: [Nodemailer](https://junglewise.ai/threats/vendors/nodemailer).

## Quick answers

**Is CVE-2026-82660 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82660 being exploited in the wild.

**How severe is CVE-2026-82660?** Medium severity, with a CVSS score of 5.4, published 31 August 2026.

**Which products and versions are affected?** Nodemailer <=8.0.8.

**Is there a fix for CVE-2026-82660?** A patch was published on 2026-06-15: Version 8.0.9 contains the fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82660 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-82660?** Check whether you run Nodemailer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a security control bypass vulnerability in Nodemailer's jsonTransport feature. The vulnerability exists because jsonTransport uses mail.normalize() to serialize messages, which calls shared.resolveContent() to process HTML, text, attachments, and other content fields. The resolveContent() function reads local files via fs.createReadStream() and fetches remote content via HTTP(S) without checking the disableFileAccess and disableUrlAccess security flags, despite these flags being copied into the message context. In contrast, the normal MIME streaming path enforces these checks in MimeNode._getStream(). An attacker who can control message fields (attachment paths, text.href, etc.) can exploit this to read arbitrary local files or trigger outbound HTTP requests. The same bypass also affects the attachDataUrls feature when enabled. Patches are available in version 8.0.9.

## Affected products

- Nodemailer Nodemailer <=8.0.8

## Identifiers

- CVE-2026-82660
- GHSA-wqvq-jvpq-h66f

## Timeline

- 2026-06-15: disclosed
- 2026-06-15: patched: Version 8.0.9 contains the fix

## References

- [https://github.com/nodemailer/nodemailer/security/advisories/GHSA-wqvq-jvpq-h66f](https://github.com/nodemailer/nodemailer/security/advisories/GHSA-wqvq-jvpq-h66f)
- [https://github.com/nodemailer/nodemailer](https://github.com/nodemailer/nodemailer)

## Related threats

- [Nodemailer address parsing bypass in addressparser](https://junglewise.ai/threats/cve-2026-125755-nodemailer-3-0-0-before-10-4-1-contains-an-address-parsing-flaw)
- [Nodemailer address parsing bypass in nested RFC 5322 comments](https://junglewise.ai/threats/cve-2026-121424-nodemailer-from-3-0-0-before-10-1-4-contains-an-address-parsing)
- [Nodemailer addressparser RFC 5322 comment parsing bypass](https://junglewise.ai/threats/nodemailer-a-nested-comment-ends-early-in-addressparser-releasing-the-4e80613c)
- [Nodemailer addressparser group terminator bypass in quoted strings](https://junglewise.ai/threats/nodemailer-a-inside-a-quoted-string-or-comment-ends-an-address-group-b8b045f9)
- [Nodemailer addressparser angle-addr parsing bypass](https://junglewise.ai/threats/nodemailer-a-inside-a-quoted-local-part-ends-an-angle-addr-early-in-28663cfb)