Executive brief
Nodemailer is a popular Node.js library for sending emails. A vulnerability in how it processes the message-level raw option allows an authenticated attacker to bypass security restrictions (disableFileAccess and disableUrlAccess) intended to prevent untrusted email content from reading local files or making server requests. An attacker can craft a malicious email with file paths or URLs that get processed anyway, with the fetched content delivered to attacker-controlled recipients—potentially exposing sensitive files like configuration files or credentials.
Technical details
The vulnerability exists in lib/mail-composer/index.js where the raw message option constructs a MimeNode without passing the disableFileAccess and disableUrlAccess security flags, unlike all other content-building code paths. When a raw message contains {path} or {href} properties, the MimeNode._getStream() method reads files via fs.createReadStream() or fetches URLs via nmfetch() without checking the access flags. The attack requires an application that: (1) accepts untrusted mail data, (2) sets disableFileAccess or disableUrlAccess to sandbox that data, and (3) passes it to transporter.sendMail(). The resulting file or HTTP response bytes become the actual sent message body across all transports (SMTP, SES, sendmail, stream, JSON). Patched in version 9.0.1.
Affected products
- Nodemailer Nodemailer <= 9.0.0
Timeline
- 2026-06-17: disclosed
- 2026-06-17: patched: Version 9.0.1 released
- 2026-08-31: advisory: GHSA-h3hj-cmcx-xc66 published as duplicate of GHSA-p6gq-j5cr-w38f
- 2026-09-02: other: GHSA-h3hj-cmcx-xc66 withdrawn as duplicate