Medium severity5.4NVD Advisory· Published Aug 31, 2026

CVE-2026-82660

Description

Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, bypassing intended access controls.

Affected products

Nodemailer/Nodemailerllm-fuzzy
Range: <8.0.9

Patches

Vulnerability mechanics

References

github.com/nodemailer/nodemailer/security/advisories/GHSA-wqvq-jvpq-h66fnvd
www.vulncheck.com/advisories/nodemailer-jsontransport-bypasses-disablefileaccess-and-disableurlaccessnvd

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000