Vulnerability · Published Aug 31, 2026 · Assigned by VulnCheck

CVE-2026-82659nodemailer before 9.0.1 File Read and SSRF via raw option

High 7.1

In plain English

A high-severity security flaw in nodemailer from nodemailer. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.3%top 71.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbitrary files or perform server-side request forgery by supplying path or href properties. Attackers can exploit this by crafting raw messages with file paths or URLs that bypass the intended sandbox, with fetched content delivered in the outgoing message to attacker-controlled recipients.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	node-nodemailer	no fix listed	DEBIAN-CVE-2026-82659
Debian:13	node-nodemailer	no fix listed	DEBIAN-CVE-2026-82659
Debian:14	node-nodemailer	9.0.3+~8.0.1-1	DEBIAN-CVE-2026-82659
Ubuntu:22.04:LTS	node-nodemailer	no fix listed	UBUNTU-CVE-2026-82659
Ubuntu:24.04:LTS	node-nodemailer	no fix listed	UBUNTU-CVE-2026-82659
Ubuntu:26.04:LTS	node-nodemailer	no fix listed	UBUNTU-CVE-2026-82659
npm	nodemailer	9.0.1	GHSA-p6gq-j5cr-w38f

Affected products (as reported)

Vendor	Product	Versions
nodemailer	nodemailer	0 – before 9.0.1

Weakness: CWE-73 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

References

GitHub Security Advisory (GHSA-p6gq-j5cr-w38f) vendor-advisory
VulnCheck Advisory: nodemailer before 9.0.1 File Read and SSRF via raw option third-party-advisory