npm/nodemailer CVE-2026-82659: high 7.1, EPSS 0.35%
Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message
Action: Upgrade nodemailer to 9.0.1 or later.
npm i nodemailer@9.0.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 9.0.1 | - |
Fixed versions
| 9.0.1 |
Sources
- osv: GHSA-p6gq-j5cr-w38f
- https://github.com/Sif-0x01/security-advisories/security/advisories/GHSA-68x8-4h5v-r533
- https://github.com/nodemailer/nodemailer/security/advisories/GHSA-p6gq-j5cr-w38f
- https://nvd.nist.gov/vuln/detail/CVE-2026-82659
- https://github.com/nodemailer/nodemailer/commit/a82e060d978f27e5f41369a9a9807b1e3dedc2e2
- https://github.com/nodemailer/nodemailer
- https://github.com/nodemailer/nodemailer/releases/tag/v9.0.1
- https://www.vulncheck.com/advisories/nodemailer-before-9.0.1-file-read-and-ssrf-via-raw-option
CVE-2026-82659 · published · modified · JSON