{"uuid": "b7bad5ef-4ae9-4f95-bc59-96c61785effc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-WQVQ-JVPQ-H66F", "type": "seen", "source": "https://gist.github.com/alon710/edcc0e217b63261cd7466683bc63318c", "content": "# GHSA-WQVQ-JVPQ-H66F: GHSA-WQVQ-JVPQ-H66F: Security Control Bypass in Nodemailer via Transport Serialization\n\n> **CVSS Score:** 5.4\n> **Published:** 2026-06-15\n> **Full Report:** https://cvereports.com/reports/GHSA-WQVQ-JVPQ-H66F\n\n## Summary\nNodemailer prior to version 8.0.9 contains a security control bypass vulnerability. Transport-level configuration parameters designed to restrict local file system access and remote URL requests are not propagated to all content-resolution execution paths. This failure allows unauthorized local file inclusion and server-side request forgery when the application utilizes specific transports or processing flags.\n\n## TL;DR\nNodemailer's disableFileAccess and disableUrlAccess security flags are bypassed when using jsonTransport or the attachDataUrls feature, enabling unauthorized local file reads and server-side request forgery.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-610\n- **Attack Vector**: Network\n- **CVSS Score**: 5.4\n- **EPSS Score**: 0.012\n- **Impact**: Information Disclosure / Server-Side Request Forgery\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Nodemailer npm package\n- **nodemailer**: < 8.0.9 (Fixed in: `8.0.9`)\n\n## Mitigation\n\n- Upgrade Nodemailer to version 8.0.9 or higher to enforce proper validation logic.\n- Apply recursive validation schema checks on all user-supplied mail configuration objects.\n- Enforce network firewall rules restricting the mail-sending process from contacting internal IP spaces.\n\n**Remediation Steps:**\n1. Run the command 'npm install nodemailer@8.0.9' to update the library to the patched version.\n2. Review the application codebase to identify occurrences of 'jsonTransport: true' or 'attachDataUrls: true'.\n3. Implement a pre-submission filter middleware to sanitize and reject arbitrary local paths or unexpected remote URLs.\n\n## References\n\n- [Nodemailer Security Advisory on GitHub](https://github.com/nodemailer/nodemailer/security/advisories/GHSA-wqvq-jvpq-h66f)\n- [Nodemailer Source Repository](https://github.com/nodemailer/nodemailer)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-WQVQ-JVPQ-H66F) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-06-15T18:41:42.000000Z"}