{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/nodemailer--9.0.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Nodemailer \u003c= 9.0.0"],"_cs_severities":["high"],"_cs_tags":["ssrf","file-read","nodemailer","nodejs","javascript","supply-chain"],"_cs_type":"advisory","_cs_vendors":["Nodemailer"],"content_html":"\u003cp\u003eA critical vulnerability exists in Nodemailer versions up to 9.0.0, where the message-level \u003ccode\u003eraw\u003c/code\u003e option can bypass the \u003ccode\u003edisableFileAccess\u003c/code\u003e and \u003ccode\u003edisableUrlAccess\u003c/code\u003e sandboxing flags. This flaw allows an attacker to achieve arbitrary local file disclosure and full-response Server-Side Request Forgery (SSRF). When an application, designed to sandbox untrusted input, calls \u003ccode\u003etransporter.sendMail()\u003c/code\u003e with the \u003ccode\u003eraw\u003c/code\u003e option influenced by an attacker, the \u003ccode\u003eMailComposer.compile()\u003c/code\u003e function fails to propagate these flags to the root MIME node. Consequently, the Nodemailer process will read local files (e.g., \u003ccode\u003e/etc/passwd\u003c/code\u003e) or fetch internal/external URLs (e.g., \u003ccode\u003ehttp://169.254.169.254/\u003c/code\u003e) and send their contents directly as the email message. This results in the exfiltration of sensitive server-side data to an attacker-specified email address, presenting a high risk to data confidentiality.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn application configured to use Nodemailer with \u003ccode\u003edisableFileAccess\u003c/code\u003e and/or \u003ccode\u003edisableUrlAccess\u003c/code\u003e for sandboxing processes untrusted user input.\u003c/li\u003e\n\u003cli\u003eAn attacker crafts malicious input for the \u003ccode\u003etransporter.sendMail()\u003c/code\u003e call, specifically targeting the \u003ccode\u003eraw\u003c/code\u003e message option.\u003c/li\u003e\n\u003cli\u003eThe attacker's input includes a malicious path (e.g., \u003ccode\u003eraw: { path: '/etc/passwd' }\u003c/code\u003e) or a malicious URL (e.g., \u003ccode\u003eraw: { href: 'http://169.254.169.254/latest/meta-data/' }\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eNodemailer's \u003ccode\u003eMailComposer.compile()\u003c/code\u003e function creates the root MIME node for the \u003ccode\u003eraw\u003c/code\u003e message without correctly applying the \u003ccode\u003edisableFileAccess\u003c/code\u003e/\u003ccode\u003edisableUrlAccess\u003c/code\u003e flags.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eMimeNode\u003c/code\u003e constructor initializes these flags to \u003ccode\u003efalse\u003c/code\u003e by default, effectively ignoring the application's intended sandboxing.\u003c/li\u003e\n\u003cli\u003eDuring message compilation, \u003ccode\u003esetRaw()\u003c/code\u003e calls \u003ccode\u003e_getStream()\u003c/code\u003e, which proceeds to read the specified local file or fetch the specified URL, as the security flags are inactive.\u003c/li\u003e\n\u003cli\u003eThe entire content of the read file or the fetched HTTP response body becomes the actual message content of the email.\u003c/li\u003e\n\u003cli\u003eNodemailer's transport mechanisms deliver this crafted email, containing sensitive server data, to an email address specified by the attacker (e.g., \u003ccode\u003eattacker@evil.test\u003c/code\u003e).\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe primary impact of this vulnerability is a high compromise of data confidentiality. Attackers can exfiltrate arbitrary local files from the server, such as \u003ccode\u003e/etc/passwd\u003c/code\u003e, \u003ccode\u003e/proc/self/environ\u003c/code\u003e, application \u003ccode\u003e.env\u003c/code\u003e files, or key material. Additionally, the full-response SSRF capability allows attackers to query internal network services or cloud metadata endpoints (e.g., \u003ccode\u003e169.254.169.254\u003c/code\u003e) and retrieve their full responses. This sensitive information is then delivered directly to an attacker-controlled mailbox, making internal data accessible to external adversaries. The vulnerability directly subverts security controls put in place by the application, rendering them ineffective for the \u003ccode\u003eraw\u003c/code\u003e message type.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003ePatch:\u003c/strong\u003e Immediately update Nodemailer to a patched version once available. Monitor the official Nodemailer repository and npm for security releases addressing GHSA-p6gq-j5cr-w38f.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eApplication-level mitigation:\u003c/strong\u003e Review all code paths that use \u003ccode\u003etransporter.sendMail()\u003c/code\u003e with the \u003ccode\u003eraw\u003c/code\u003e option. Ensure that untrusted user input cannot directly influence the \u003ccode\u003epath\u003c/code\u003e or \u003ccode\u003ehref\u003c/code\u003e properties within the \u003ccode\u003eraw\u003c/code\u003e object. Implement strict input validation and sanitization.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eDeployment:\u003c/strong\u003e Deploy the provided Sigma rules to your SIEM/EDR to detect attempts at SSRF and suspicious file access by Node.js processes on Linux hosts.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eLogging:\u003c/strong\u003e Ensure comprehensive logging for process activity, file access, and network connections on servers hosting Node.js applications, particularly on Linux systems, to facilitate detection and investigation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-06-18T14:54:24Z","date_published":"2026-06-18T14:54:24Z","id":"https://feed.craftedsignal.io/briefs/2026-06-nodemailer-raw-bypass/","summary":"Nodemailer versions up to 9.0.0 are vulnerable to arbitrary local file read and full-response Server-Side Request Forgery (SSRF) when handling untrusted input for the message-level `raw` option, bypassing intended security flags and allowing sensitive content to be exfiltrated via an attacker-controlled recipient.","title":"Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF","url":"https://feed.craftedsignal.io/briefs/2026-06-nodemailer-raw-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Nodemailer \u003c= 9.0.0","version":"https://jsonfeed.org/version/1.1"}