Description

nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbitrary files or perform server-side request forgery by supplying path or href properties. Attackers can exploit this by crafting raw messages with file paths or URLs that bypass the intended sandbox, with fetched content delivered in the outgoing message to attacker-controlled recipients.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-31T09:17:03.633Z",
  "pubdate": "2026-08-31T09:17:03.633Z",
  "executiveSummary": "A critical security flaw exists in Nodemailer versions prior to 9.0.1, involving improper input validation and configuration enforcement. The vulnerability is classified as an improper restriction of file and network access, enabling unauthorized file system read and Server-Side Request Forgery (SSRF) attacks.\nThe vulnerability occurs because the 'disableFileAccess' and 'disableUrlAccess' security flags are incorrectly applied when processing message-level raw options. Consequently, an authenticated attacker can bypass these sandboxing constraints.\nThe primary impact involves the unauthorized disclosure of sensitive local files or the ability to force the server to initiate network requests to internal or external resources. By embedding malicious path or href properties within the raw message structure, an attacker can exfiltrate retrieved content to an external, attacker-controlled recipient address.\nThis vulnerability poses a significant risk to confidentiality and internal network integrity, particularly in environments where Nodemailer is used in multi-tenant or untrusted user input scenarios. Successful exploitation requires the attacker to be authenticated within the application that utilizes the affected Nodemailer instance.",
  "technicalDetails": "The root cause of this vulnerability lies in a logic error within the Nodemailer message parsing pipeline for versions prior to 9.0.1. Specifically, the library fails to propagate or enforce the 'disableFileAccess' and 'disableUrlAccess' configuration flags when processing objects supplied via the 'raw' property of a mail message.\nIn a secure configuration, these flags are intended to sanitize and block file system access (e.g., via 'path' properties) and external network fetches (e.g., via 'href' properties) to prevent SSRF. Because the validation logic is bypassed at the message-level raw option, the underlying transport mechanisms treat these inputs as trusted directives.\nThe attack flow proceeds as follows: 1) An authenticated attacker initiates a message transmission process via the application interface using Nodemailer. 2) The attacker crafts a malicious raw message payload containing a 'path' property pointing to a sensitive local file (e.g., /etc/passwd or application configuration files) or an 'href' property targeting internal metadata services or private network endpoints. 3) Upon calling the sendMail function, the library fails to check these properties against the active security policy, as the enforcement mechanism is restricted to standard attachment objects rather than raw message structures. 4) Nodemailer proceeds to read the local file or perform an HTTP/HTTPS GET request to the specified URL. 5) The content fetched from the file system or the remote resource is then processed by the transport layer and included in the final outbound email. 6) The resulting email, containing the exfiltrated sensitive data, is dispatched to an attacker-controlled email address.\nThis vulnerability effectively turns the Nodemailer instance into a proxy for internal resource harvesting. Because the exploitation occurs during the mail composition and dispatch phase, the impact is limited by the system privileges of the Node.js process. If the process runs with elevated system permissions, the potential for sensitive information disclosure is high. Furthermore, this facilitates SSRF, allowing attackers to probe firewalled internal infrastructure that is otherwise inaccessible from the public internet. The lack of validation on the raw option prevents the intended sandbox from functioning as a security boundary, rendering the 'disableFileAccess' and 'disableUrlAccess' settings ineffective against specifically crafted malicious input payloads."
}