Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

High severity, with a CVSS score of 7.1, published 31 August 2026.

Which products and versions are affected?

Nodemailer Project Nodemailer before 9.0.1.

Is there a fix for This vulnerability?

A patch was published on 2026: Fix released in version 9.0.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Nodemailer raw message option bypasses disableFileAccess/disableUrlAccess

Severity: high · CVSS 7.1 · Published 2026-08-31

Nodemailer is a widely-used Node.js library for sending emails. The library provides disableFileAccess and disableUrlAccess flags to prevent untrusted input from accessing local files or making network requests. However, the raw message option bypasses these protections, allowing an authenticated attacker to read sensitive files (like config files or environment variables) or make requests to internal systems. An attacker can exploit this to exfiltrate secrets or gather information about internal infrastructure, with the results delivered to their email address.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: High severity, with a CVSS score of 7.1, published 31 August 2026.
Which products and versions are affected?: Nodemailer Project Nodemailer before 9.0.1.
Is there a fix for This vulnerability?: A patch was published on 2026: Fix released in version 9.0.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in lib/mail-composer/index.js where the raw message handling path fails to pass the disableFileAccess and disableUrlAccess flags to the MimeNode constructor, unlike all other content-building paths (_createMixed, _createAlternative, _createRelated, _createContentNode). When a raw message with {path: '/etc/passwd'} or {href: 'http://internal-server'} properties is supplied, the MimeNode._getStream() method reads files via fs.createReadStream or fetches URLs via nmfetch without respecting the access control flags, since they default to false on the raw node. The resulting bytes are then emitted as the message body by all transports (SMTP, SES, sendmail, stream, JSON). Exploitation requires that the application has configured disableFileAccess and/or disableUrlAccess (indicating untrusted input handling) and that the attacker-controlled raw field and to field are passed to sendMail(). The fix is to pass the access control flags when constructing the MimeNode in the raw message path, which was patched in version 9.0.1.

Affected products

Nodemailer Project Nodemailer before 9.0.1

Timeline

2026-06-17: disclosed: Original advisory GHSA-p6gq-j5cr-w38f published
2026: patched: Fix released in version 9.0.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.