Executive brief
Nodemailer is a widely-used Node.js library for sending emails. The library provides security options (disableFileAccess and disableUrlAccess) that prevent untrusted email content from reading local files or making outbound requests. A flaw in the public API allows attackers to bypass these sandbox protections when the legacy function signature is used, potentially enabling file theft and server-side request forgery attacks.
Technical details
The vulnerability is a security sandbox bypass in the MailMessage.resolveContent() public API. When called with the documented legacy 3-argument signature (data, key, callback), the function fails to pass the transporter-level disableFileAccess and disableUrlAccess flags to the underlying shared.resolveContent() function, which normalizes missing options to an empty object. As a result, resolveContentValue skips access-control guards and reaches nmfetch() for SSRF or fs.createReadStream() for arbitrary file reads. The vulnerability affects applications that use the public plugin API to resolve message content; direct transporter.sendMail() calls are unaffected because they use internal code paths that correctly thread the flags. The issue was introduced by a previous GHSA-wqvq-jvpq-h66f fix and persists in version 9.1.0. Patch version 9.1.1 is available.
Affected products
- Nodemailer Nodemailer <= 9.1.0
Timeline
- 2026-09-08: disclosed
- 2026-09-01: patched: Patched in version 9.1.1