CVE-2026-82660 nodemailer CVE debrief

Who should care

Users of Nodemailer versions before 8.0.9, security teams monitoring for potential local file reads or URL fetches, and developers using Nodemailer in their applications should be aware of this vulnerability. They should review the vendor guidance, perform inventory checks, and consider compensating controls for affected systems.

Technical summary

Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport, allowing attackers to read local files or fetch URLs by supplying path or href values in message content fields. This vulnerability has a CVSS score of 5.3 and is classified as MEDIUM severity. The affected product is Nodemailer, and the vulnerability impacts users of versions before 8.0.9.

Defensive priority

Medium priority given the CVSS score of 5.3 and potential for local file reads or URL fetches.

Recommended defensive actions

• Inventory checks for Nodemailer versions before 8.0.9
• Apply vendor remediation when available
• Monitor for potential local file reads or URL fetches
• Consider compensating controls for affected systems
• Review system logs for suspicious activity
• Perform vulnerability scans
• Implement additional security measures

Evidence notes

Evidence is limited; verify with primary official records and vendor remediation status. Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Limited evidence suggests attackers could read local files or fetch URLs by supplying path or href values in message content fields. Defenders should verify affected systems, review vendor guidance, and monitor for potential misuse.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.