Nodemailer resolveContent sandbox bypass in legacy signature

Executive brief

Nodemailer is a popular Node.js library for sending emails. Applications using Nodemailer's security sandbox features (disableFileAccess and disableUrlAccess) to prevent untrusted email content from reading local files or making network requests can have that protection bypassed when using the documented plugin API with its legacy 3-argument signature. An attacker who can influence email message content could read sensitive local files or make requests to internal servers.

Technical details

The vulnerability is an access-control bypass in Nodemailer's content resolution path. When MailMessage.resolveContent(data, key, callback) is called with the documented 3-argument legacy signature, the method acts as a raw passthrough to shared.resolveContent(), which normalizes missing options to an empty object. This causes the disableFileAccess and disableUrlAccess flags—already copied to mail.data by the MailMessage constructor—to be silently discarded. resolveContentValue then skips access-control guards and reaches nmfetch() (leading to SSRF via href attributes) or fs.createReadStream() (arbitrary file read via path attributes). The default transporter.sendMail() path and explicit-options API calls remain protected. Exploitation requires the sandbox flags to be explicitly enabled (non-default) and the application or a plugin to invoke the legacy-signature API on attacker-influenced message content.

Affected products

• Nodemailer nodemailer <= 9.1.0

Timeline

• 2026-09-08: disclosed: Advisory published
• 2026-09-08: patched: Fix released in version 9.1.1

References

• https://api.github.com/users/Hcamael
• https://github.com/Hcamael
• https://api.github.com/users/Hcamael/gists%7B/gist_id%7D
• https://api.github.com/users/Hcamael/repos
• https://avatars.githubusercontent.com/u/10161996?v=4
• https://api.github.com/users/Hcamael/events%7B/privacy%7D