CVE-2026-82659

Nodemailer before 9.0.1 fails to apply the disableFileAccess and disableUrlAccess sandbox flags to the message-level raw option, allowing a sandbox bypass. An authenticated attacker who can influence outgoing message content can craft raw messages containing a path or href property, causing the server to read arbitrary local files or fetch attacker-chosen URLs, with the fetched content delivered inside the outgoing message to attacker-controlled recipients. This yields arbitrary file disclosure and server-side request forgery (SSRF) on the email-sending host, and potentially exposure of internal network endpoints via SSRF. Any Node.js application using a vulnerable nodemailer version is exposed, but practical risk is concentrated in deployments that enable the sandbox flags while passing attacker-controlled raw message data, since the attack requires low (authenticated) privileges. No public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at just 0.3%, so no active exploitation is currently indicated.

What to do: Upgrade nodemailer to 9.0.1 or later. Audit your code for use of the message-level raw option together with disableFileAccess/disableUrlAccess and for any flow where authenticated users can supply raw message content; as an interim mitigation, validate or restrict path and href values in raw messages and limit which authenticated users can set them. Monitor for updates, as no public PoC or in-the-wild exploitation is known but public disclosure may drive rapid attacker interest.