CVE-2026-82660

EUVD-2026-68438
Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, bypassing intended access controls.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
5.4 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 8.57%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
nodemailernodemailer
𝑥
< 8.0.9
CNA
Debian logo
Debian Releases
Debian Product
Codename
node-nodemailer
bookworm
vulnerable
bullseye
vulnerable
forky
9.0.5+~8.0.1-1
fixed
sid
9.0.6+~8.0.1-1
fixed
trixie
vulnerable
Common Weakness Enumeration
References
https://github.com/nodemailer/nodemailer/security/advisories/GHSA-wqvq-jvpq-h66f
https://www.vulncheck.com/advisories/nodemailer-jsontransport-bypasses-disablefileaccess-and-disableurlaccess
https://github.com/nodemailer/nodemailer/security/advisories/GHSA-wqvq-jvpq-h66f