Nodemailer MailComposer Security Bypass Vulnerability

Nodemailer versions 9.0.0 and earlier contain a security bypass vulnerability in the MailComposer component. The vulnerability exists because the library fails to thread the 'disableFileAccess' and 'disableUrlAccess' configuration flags when constructing the root node of a message using the 'raw' option. While Nodemailer correctly enforces these security restrictions for standard attachments and alternative nodes, the omission of these flags in the 'raw' node creation logic allows untrusted inputs to circumvent security policies.

This issue is tracked under GHSA-p6gq-j5cr-w38f. Attackers can leverage this bypass to perform arbitrary local file reads or Server-Side Request Forgery (SSRF) against internal or external resources. Applications that rely on these flags to sanitize user-provided message data are directly impacted, as the bypass permits the processing of malicious 'path' or 'href' parameters that should otherwise be blocked. This vulnerability was confirmed in version 9.0.0 and fixed in 9.0.1.

Impact

The impact of this vulnerability includes potential unauthorized access to sensitive local system files and the ability to conduct SSRF attacks. If an application processes user-supplied input to generate emails via Nodemailer, an attacker could read internal configuration files, credentials, or make unauthorized requests to internal services that are not reachable from the public internet. The scope of impact is dependent on the application context and the privileges of the service account running the Node.js application.

Recommendation

• Update the Nodemailer library to version 9.0.1 or later to apply the necessary security flag enforcement.
• Audit existing application code to ensure that user-supplied input is validated before being passed into the MailComposer 'raw' configuration, even after updating the library.
• Review internal application logs for unexpected file access patterns or connection attempts originating from the application server to sensitive internal endpoints if suspicious behavior is detected.