Skip to content
Threat Feed
Subscribe

Vendor

Nodemailer

1 brief RSS
high advisory

Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF

Nodemailer versions up to 9.0.0 are vulnerable to arbitrary local file read and full-response Server-Side Request Forgery (SSRF) when handling untrusted input for the message-level `raw` option, bypassing intended security flags and allowing sensitive content to be exfiltrated via an attacker-controlled recipient.

Nodemailer <= 9.0.0 ssrf file-read nodemailer nodejs javascript supply-chain
2r 3t 2i