Skip to content
Threat Feed
Subscribe

Tag

Nodemailer

2 briefs RSS
high advisory

Nodemailer SSRF and Arbitrary File Read Vulnerability

Nodemailer versions before 9.0.1 fail to enforce security flags when processing message-level raw options, allowing authenticated attackers to perform SSRF and read arbitrary files.

nodemailer +1 vulnerability ssrf file-access smtp-injection
3t 1c
high advisory

Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF

Nodemailer versions up to 9.0.0 are vulnerable to arbitrary local file read and full-response Server-Side Request Forgery (SSRF) when handling untrusted input for the message-level `raw` option, bypassing intended security flags and allowing sensitive content to be exfiltrated via an attacker-controlled recipient.

Nodemailer <= 9.0.0 ssrf file-read nodemailer nodejs javascript supply-chain
2r 3t 2i