Executive brief
Nodemailer is a widely-used Node.js library for sending emails. The library provides disableFileAccess and disableUrlAccess flags to prevent untrusted input from accessing local files or making network requests. However, the raw message option bypasses these protections, allowing an authenticated attacker to read sensitive files (like config files or environment variables) or make requests to internal systems. An attacker can exploit this to exfiltrate secrets or gather information about internal infrastructure, with the results delivered to their email address.
Technical details
The vulnerability exists in lib/mail-composer/index.js where the raw message handling path fails to pass the disableFileAccess and disableUrlAccess flags to the MimeNode constructor, unlike all other content-building paths (_createMixed, _createAlternative, _createRelated, _createContentNode). When a raw message with {path: '/etc/passwd'} or {href: 'http://internal-server'} properties is supplied, the MimeNode._getStream() method reads files via fs.createReadStream or fetches URLs via nmfetch without respecting the access control flags, since they default to false on the raw node. The resulting bytes are then emitted as the message body by all transports (SMTP, SES, sendmail, stream, JSON). Exploitation requires that the application has configured disableFileAccess and/or disableUrlAccess (indicating untrusted input handling) and that the attacker-controlled raw field and to field are passed to sendMail(). The fix is to pass the access control flags when constructing the MimeNode in the raw message path, which was patched in version 9.0.1.
Affected products
- Nodemailer Project Nodemailer before 9.0.1
Timeline
- 2026-06-17: disclosed: Original advisory GHSA-p6gq-j5cr-w38f published
- 2026: patched: Fix released in version 9.0.1