CVE-2026-82659: nodemailer SSRF Vulnerability

CVE-2026-82659 Overview

CVE-2026-82659 affects the nodemailer Node.js library in versions prior to 9.0.1. The library fails to enforce the disableFileAccess and disableUrlAccess flags on the message-level raw option. Authenticated attackers can supply path or href properties inside a raw message to read arbitrary files from the server or trigger server-side request forgery (SSRF). Fetched content is delivered in the outgoing message to attacker-controlled recipients, providing a reliable exfiltration channel. The weakness is classified under CWE-73: External Control of File Name or Path.

Critical Impact
Attackers with authenticated access to mail-sending functionality can exfiltrate arbitrary local files and reach internal network services through SSRF, bypassing sandboxing flags intended to prevent this behavior.

Affected Products

nodemailer versions prior to 9.0.1
Applications relying on disableFileAccess to restrict local file access in outbound messages
Applications relying on disableUrlAccess to prevent outbound URL fetches during message assembly

Discovery Timeline

2026-08-31 - CVE-2026-82659 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-82659

Vulnerability Analysis

The vulnerability resides in how nodemailer processes the message-level raw option. When a caller passes an object to raw containing a path property, the library reads the referenced local file. When the object contains an href property, the library fetches the referenced URL. Both operations proceed even when the transport was configured with disableFileAccess: true or disableUrlAccess: true. The retrieved bytes are placed into the raw MIME source of the message and delivered to the recipient list, giving an authenticated attacker a direct data-exfiltration primitive.

Root Cause

The sandboxing flags are enforced on attachment and alternative content builders, but the code path handling the raw option does not consult them before dereferencing path or href. This is a classic access-control gap where security policy is implemented in some, but not all, resource resolution paths.

Attack Vector

Exploitation requires authenticated access to an application that lets a user influence the raw field passed to nodemailer. The attacker crafts a message where raw is an object such as { path: '/etc/passwd' } or { href: 'http://169.254.169.254/latest/meta-data/' } and sets the recipient to an inbox they control. Upon send, nodemailer reads the file or performs the HTTP request and includes the response body in the transmitted message. Because the fetch originates from the mail server, the attacker can reach internal-only services that would normally be unreachable from their network position. Refer to the GitHub Security Advisory GHSA-p6gq-j5cr-w38f and the VulnCheck advisory for the technical write-up.

Detection Methods for CVE-2026-82659

Indicators of Compromise

Outbound emails originating from application servers where the message body contains contents of local configuration files, /etc/passwd, private keys, or cloud metadata responses.
Unexpected outbound HTTP requests from mail-sending hosts to internal RFC1918 addresses, 169.254.169.254, or non-mail external endpoints.
Application logs showing raw message payloads that include path or href fields controlled by user input.

Detection Strategies

Inventory Node.js dependency trees for nodemailer versions below 9.0.1 using npm ls nodemailer or software composition analysis tools.
Grep application source for calls to transporter.sendMail where the raw property receives objects sourced from request bodies or database records.
Correlate outbound SMTP send events with process-level file reads and DNS lookups on mail-relay hosts to spot anomalies.

Monitoring Recommendations

Alert on mail-sending processes performing file reads outside expected template directories or issuing HTTP requests to metadata and internal endpoints.
Track message sizes and recipient domains; sudden large messages to free webmail domains from service accounts warrant review.
Enable structured logging around the nodemailer send pipeline to capture the shape of the raw argument prior to send.

How to Mitigate CVE-2026-82659

Immediate Actions Required

Upgrade nodemailer to version 9.0.1 or later across all Node.js services.
Audit application code paths that expose raw message construction to authenticated users and reject objects containing path or href.
Rotate any credentials, tokens, or keys stored on hosts where exploitation may have occurred.

Patch Information

The maintainers fixed the issue in nodemailer 9.0.1 by applying the disableFileAccess and disableUrlAccess flags to the raw option code path. Upgrade guidance and the fix commit are referenced in the GitHub Security Advisory GHSA-p6gq-j5cr-w38f.

Workarounds

Configure transports with disableFileAccess: true and disableUrlAccess: true, and additionally validate the raw argument at the application layer to accept only strings or Buffers.
Restrict egress from mail-sending hosts using network policy so that SSRF cannot reach metadata services or internal APIs.
Run the Node.js process under a least-privilege service account with a filesystem view that excludes sensitive files.

bash

# Configuration example
npm install nodemailer@^9.0.1
npm ls nodemailer