Executive brief
Nodemailer is a popular library for sending emails in Node.js applications. A security flaw in its JSON transport component allows attackers to bypass restrictions meant to prevent the library from reading local files or making unauthorized web requests. This could allow an attacker to steal sensitive files from the server or probe internal network services by including malicious paths or links in email content.
Technical details
A vulnerability exists in Nodemailer's `jsonTransport` where the `disableFileAccess` and `disableUrlAccess` security options are not enforced during message normalization. While these flags are correctly checked during normal MIME streaming, `jsonTransport` calls `mail.normalize()`, which utilizes `shared.resolveContent()` to resolve attachments and message parts (html, text, etc.) before MIME generation. Because `shared.resolveContent()` lacks access control checks, an attacker who can control message fields like `attachment.path` or `text.href` can force the application to read local files into the JSON output or perform outbound HTTP requests (SSRF). This also affects the `attachDataUrls` feature. The issue is fixed in version 8.0.9.
Affected products
- nodemailer nodemailer <= 8.0.8
Timeline
- 2026-05-26: disclosed
- 2026-06-15: advisory
- 8.0.9: patched