{"items":[{"id":"NVI-00013786","kind":"vulnerability","title":"Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-p6gq-j5cr-w38f","CVE-2026-82659"],"plain_summary":"GitHub lists this reviewed advisory for nodemailer. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-039db5bf42e53a495e0b8e5068dc0545"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-02T14:47:23.000Z","value":"7.1 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-039db5bf42e53a495e0b8e5068dc0545"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-039db5bf42e53a495e0b8e5068dc0545","url":"https://github.com/advisories/GHSA-p6gq-j5cr-w38f","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-p6gq-j5cr-w38f","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T02:21:43.711Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-039db5bf42e53a495e0b8e5068dc0545"],"technology":"nodemailer","known_exclusions":[],"conditions_summary":"# Message-level `raw` option bypasses `disableFileAccess` / `disableUrlAccess`, enabling arbitrary file read and full-response SSRF in the sent message\n\n- **Target:** nodemailer/nodemailer, npm `nodemailer` **v9.0.0** (HEAD `4e58450eb490e5097a74b2b2cce35a8d9e21856e`)\n- **Verdict:** CONFIRMED (local PoC, no network)\n\n## Summary\n\nNodemailer exposes `disableFileAccess` and `disableUrlAccess` so an application that passes\n**untrusted** message data to the library can forbid that data from reading local files or\nfetching URLs. Every attachment, alternative, `html`/`text`/`watchHtml`/`amp` and `icalEvent`\ncontent node honors these flags. **The message-level `raw` option does not.**\n\n`MailComposer.compile()` builds the root MIME node for a `raw` message **without** threading the\ntwo flags, so a `raw: { path: '/etc/passwd' }` or `raw: { href: 'http://169.254.169.254/…' }`\nmessage is read / fetched anyway, and the file or HTTP-response bytes become the **actual\nmessage that is sent** by every transport (SMTP, SES, sendmail, stream, JSON). An actor whose\ninput the application intended to sandbox therefore obtains arbitrary local-file disclosure and\na full-response SSRF primitive, delivered t","public_affected_ranges":["<= 9.0.0"]}],"null_published_at":"2026-11-02T10:00:37.148Z","source_updated_at":"2026-09-02T14:47:23.000Z","source_disclosed_at":"2026-06-18T14:28:05.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-02T02:21:43.711Z"}],"next_cursor":null,"snapshot_revision":"42594"}