CVE-2026-82660

EUVD-2026-68438
Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, bypassing intended access controls.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
5.4 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 16.46%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
nodemailernodemailer
𝑥
< 8.0.9
CNA
Debian logo
Debian Releases
Debian Product
Codename
node-nodemailer
bookworm
postponed
forky
10.0.13+~8.0.2-1
fixed
sid
10.0.14+~8.0.2-1
fixed
trixie
no-dsa
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
node-nodemailer
focal
needs-triage
jammy
needs-triage
noble
needs-triage
resolute
needs-triage
Common Weakness Enumeration
References
https://github.com/nodemailer/nodemailer/security/advisories/GHSA-wqvq-jvpq-h66f
https://www.vulncheck.com/advisories/nodemailer-jsontransport-bypasses-disablefileaccess-and-disableurlaccess
https://github.com/nodemailer/nodemailer/security/advisories/GHSA-wqvq-jvpq-h66f