Nodemailer (< 9.0.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/nodemailer--9.0.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 31 Aug 2026 11:17:45 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgNodemailer SSRF and Arbitrary File Read Vulnerabilityhttps://feed.craftedsignal.io/briefs/2026-08-nodemailer-ssrf-file-read/Mon, 31 Aug 2026 11:17:45 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-nodemailer-ssrf-file-read/Nodemailer versions before 9.0.1 fail to enforce security flags when processing message-level raw options, allowing authenticated attackers to perform SSRF and read arbitrary files.Nodemailer versions prior to 9.0.1 contain a security oversight where the 'disableFileAccess' and 'disableUrlAccess' flags are not properly applied when processing message-level 'raw' options. This flaw allows an authenticated attacker to provide malicious path or href properties within the email structure. By exploiting this, an attacker can coerce the server into performing server-side request forgery (SSRF) to interact with internal resources or to read arbitrary files from the filesystem. The contents of these files or the response from the internal requests are then exfiltrated to an attacker-controlled recipient via the outgoing email message. This vulnerability poses a significant risk to applications using Nodemailer to process user-supplied email content or templates, as it bypasses intended security sandbox restrictions.

Impact

Successful exploitation allows authenticated users to exfiltrate sensitive internal configuration files, credentials, or metadata via email. It also facilitates SSRF, enabling attackers to probe internal network services and sensitive APIs that are not exposed to the public internet, potentially leading to further compromise of the internal environment.

Recommendation

Update Nodemailer to version 9.0.1 or later immediately to ensure that 'disableFileAccess' and 'disableUrlAccess' flags are correctly enforced during message processing.

]]>highadvisoryvulnerabilityssrffile-accesssmtp-injectionnodemailer