CVE-2026-82659
Received Received - Intake

Nodemailer Path Traversal and SSRF via Message-Level Raw Option

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: VulnCheck

Description
nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbitrary files or perform server-side request forgery by supplying path or href properties. Attackers can exploit this by crafting raw messages with file paths or URLs that bypass the intended sandbox, with fetched content delivered in the outgoing message to attacker-controlled recipients.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-82659
EUVD
EUVD-2026-68437

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nodemailer nodemailer to 9.0.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects nodemailer versions before 9.0.1. It allows authenticated attackers to read arbitrary files or perform server-side request forgery (SSRF) by exploiting improper handling of the raw message option. Attackers can bypass security flags like disableFileAccess and disableUrlAccess, crafting malicious raw messages that fetch or read content, which is then delivered to attacker-controlled recipients.

Detection Guidance

Check nodemailer version with npm list nodemailer. If version is below 9.0.1, the system is vulnerable. Review application code for raw message handling and ensure disableFileAccess and disableUrlAccess flags are properly set.

Impact Analysis

If you use nodemailer versions before 9.0.1, attackers with access could read sensitive files on your server or make unauthorized requests to internal systems. This could lead to data breaches, unauthorized access to confidential information, or further network compromise through SSRF attacks.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations may face compliance violations, legal penalties, or reputational damage if exploited.

Mitigation Strategies

Upgrade nodemailer to version 9.0.1 or later. Ensure disableFileAccess and disableUrlAccess flags are applied to all raw message options. Review and sanitize any untrusted input used in raw message fields.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82659. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart