Executive brief
Nodemailer, a popular library for sending emails in Node.js applications, contains a vulnerability that allows attackers to bypass security restrictions intended to prevent access to local files and internal URLs. By providing a specially crafted 'raw' message object, an attacker can trick the system into reading sensitive files from the server (such as configuration files or credentials) or accessing internal network services. These stolen files or internal data are then sent directly to an email address of the attacker's choosing, leading to significant data exposure.
Technical details
Nodemailer's 'MailComposer.compile()' builds the root MIME node for messages using the 'raw' option without propagating the 'disableFileAccess' and 'disableUrlAccess' security flags. While these flags are correctly enforced for attachments and other content nodes, the 'raw' code path in 'lib/mail-composer/index.js' bypasses these guards. An attacker who can control the 'raw' property of a message (e.g., providing an object with a 'path' or 'href' key) can trigger 'fs.createReadStream' or 'nmfetch' to read local files or perform SSRF. The resulting data is then included as the body of the outgoing email. This affects all transports including SMTP, SES, and sendmail. The vulnerability is patched in version 9.0.1.
Affected products
- nodemailer nodemailer <= 9.0.0
Timeline
- 2026-06-17: advisory: GHSA-p6gq-j5cr-w38f published
- 2026-06-18: disclosed
- 2026-06-17: patched: Fixed in version 9.0.1