Description

Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, bypassing intended access controls.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-31T09:17:03.790Z",
  "pubdate": "2026-08-31T09:17:03.790Z",
  "executiveSummary": "Nodemailer versions prior to 8.0.9 contain a critical vulnerability in the message normalization process within the jsonTransport component. The vulnerability is characterized by a failure to enforce security configuration options, specifically disableFileAccess and disableUrlAccess. This flaw allows unauthorized entities to bypass intended security constraints, enabling arbitrary local file system access or unauthorized remote URL fetching.\nThe vulnerability poses a significant risk to confidentiality and integrity, as an attacker can manipulate message content fields—specifically path and href attributes—to coerce the application into reading sensitive local configuration files, source code, or internal network resources. Because these security flags are ignored during normalization, the system fails to apply the expected sandboxing or restriction policies, effectively neutralizing the intended protection mechanisms. Exploitation does not necessarily require complex authentication if the attacker can influence the input processed by the jsonTransport module. Successful exploitation may lead to unauthorized data exfiltration or potential server-side request forgery (SSRF), depending on the deployment environment and the accessibility of internal resources to the Nodemailer service.",
  "technicalDetails": "The vulnerability resides within the message normalization logic of the Nodemailer library, specifically affecting the jsonTransport transport mechanism. The root cause is an implementation oversight where the normalization routines fail to validate or respect the disableFileAccess and disableUrlAccess configuration flags when processing incoming message objects. These flags were explicitly designed to restrict the library's ability to interact with the host file system and initiate outgoing HTTP/HTTPS requests based on user-supplied content.\nUnder normal operations, these options serve as a security boundary to ensure that mail content is treated as static data. However, due to the failure in the normalization layer, the transport mechanism processes attachment paths or linked URL resources without verifying if the corresponding access has been toggled off. When a message is prepared for transport, the jsonTransport component attempts to resolve or fetch these resources if specified in the message structure.\nThe attack flow proceeds as follows: 1) An attacker crafts a malicious message payload containing targeted file system paths (e.g., /etc/passwd or application-specific configuration files) or sensitive internal URLs in the path or href attributes of the message content. 2) The application passes this crafted object to Nodemailer’s jsonTransport. 3) The normalization phase, which should truncate or sanitize these fields based on the disableFileAccess and disableUrlAccess settings, ignores these constraints. 4) The library proceeds to read the specified file or resolve the remote URL using the privileges of the underlying Node.js process. 5) The resulting data is subsequently included in the output of the jsonTransport, allowing the attacker to view the contents of local files or perform requests to internal services that were intended to be unreachable.\nThis vulnerability is particularly impactful in environments where applications allow user-controllable input to influence email composition. Because this occurs at the library level, any application utilizing Nodemailer versions prior to 8.0.9 for JSON-based transport is susceptible. The exploitation requires no specialized privileges beyond the ability to trigger an email creation flow that utilizes the vulnerable transport method. Post-exploitation, the attacker gains the ability to map the internal directory structure, extract sensitive application secrets, or leverage the server as a proxy to scan internal network segments."
}