CVE-2026-82659

Executive Summary

CVE-2026-82659 is a sandbox bypass vulnerability in Nodemailer versions prior to 9.0.1, where the disableFileAccess and disableUrlAccess security flags fail to apply to the message-level raw option. This flaw allows authenticated attackers to read arbitrary local files from the mail server host or perform server-side request forgery (SSRF) by embedding file paths or URLs in crafted raw messages, with the fetched content delivered to attacker-controlled recipients via outbound email. The vulnerability carries a CVSS score of 7.1 (High), an EPSS score of 0.00254, and currently has no public exploit code or known in-the-wild exploitation, though patch confirmation is limited to a single source.

Technical Analysis

Nodemailer is a widely used Node.js library for sending emails from applications. Historically, it provides two security flags — disableFileAccess and disableUrlAccess — that prevent the library from fetching content from local file paths or remote URLs when processing message attachments or content. These flags exist to sandbox the mail-sending process and prevent an attacker who controls message content from causing the server to read sensitive local files or reach internal network resources.

The vulnerability arises because these flags are enforced on certain message properties (such as standard attachment handling) but not on the message-level raw option. The raw option allows a caller to supply a pre-formed MIME message that Nodemailer will transmit as-is without further processing. Because the validation that applies the disable flags is absent on this path, an attacker who is able to pass raw message content to the library can bypass the intended sandbox.

The attack mechanics are as follows:

1. An authenticated attacker (one who has legitimate access to an application feature that sends emails, or who can inject message content into a mail-sending function) supplies a raw option containing MIME parts with <file://...> or <http://...> style references.
2. The mail server processes these references during the message rendering or MIME processing stage, despite the declared disableFileAccess and disableUrlAccess flags being set.
3. For file paths, the library reads the referenced local file and embeds its contents into the outgoing message body or attachment.
4. For URLs, the library performs a server-side HTTP request to the supplied URL, fetching whatever content is returned and including it in the outgoing message.
5. The outgoing message is delivered to a recipient address controlled by the attacker, who then receives the exfiltrated data.

The root cause is inconsistent enforcement of security constraints across different code paths within the same library — a classic authorization/sandbox logic error (CWE-73: External Control of File Name or Path). It is not a memory corruption issue; it is a straight logic flaw where an access-control check exists but is not invoked for one particular message processing branch.

The attacker requires authentication to the application that uses Nodemailer (CVSS PR:L), and the attack can be launched over the network (AV:N). The confidentiality impact is high (C:H) because arbitrary file contents can be exfiltrated, while integrity impact is low (I:L) — an attacker can potentially inject content into outbound emails, though not modify server-side data directly.

Exploitation Scenarios

No public PoC is available for CVE-2026-82659; the attack chain below is inferred from the vulnerability description at the class level.

Scenario: File Disclosure via Web Application with HTML Email Generation

1. Reconnaissance / Target Identification: An attacker identifies a web application built with Node.js that uses an affected Nodemailer version (< 9.0.1). The application exposes a feature where an authenticated user can send emails — e.g., a "contact us" form, a "share this page" function, a password-reset notification service, or a document-delivery portal. The attacker confirms the library version by fingerprinting (e.g., analyzing package.json leaks, stack traces, or behavior differences).

2. Triggering the Flaw: The attacker crafts a request to the mail-sending feature that causes the application to pass attacker-influenced content into the raw option of Nodemailer's message object. If the application composes email content from user-supplied fields (e.g., message body, subject, or a URL input), the attacker embeds a reference like a file path or a URL that Nodemailer will resolve. Because the disableFileAccess and disableUrlAccess flags are not enforced on the raw path, the resolution proceeds.

3. Payload / Execution: For file disclosure, the attacker supplies a value such as a reference to /etc/passwd or an application configuration file (e.g., database credentials, API keys, or private keys) as a file-path reference within the raw message. For SSRF, the attacker supplies a URL to an internal service, such as http://169.254.169.254/latest/meta-data/ (cloud metadata) or an internal admin panel. Nodemailer's MIME processing fetches the content and includes it in the email body.

4. Post-Exploitation Impact: The email is delivered to an email address controlled by the attacker (they set the To field or the recipient list). The attacker receives the exfiltrated content out-of-band. With file contents in hand, the attacker can escalate — e.g., using exposed database credentials or cloud IAM tokens to move laterally. With SSRF, they can probe internal network services, potentially reaching management interfaces not normally accessible from the internet.

Impact Assessment

Business Impact: Applications using Nodemailer < 9.0.1 that allow any authenticated user to influence email content (particularly via the raw option) are exposed to arbitrary file disclosure and SSRF. This can lead to:

• Confidentiality breach (HIGH): Reading arbitrary files from the mail host, including application secrets, configuration files, SSH keys, and database credentials.
• Integrity impact (LOW): An attacker can inject content into outbound emails to manipulate recipients or phish them with forged content.
• Lateral movement: Exfiltrated credentials can be leveraged to pivot to backend systems.
• Internal network reconnaissance: SSRF enables probing of internal IP ranges and cloud metadata endpoints, potentially exposing IAM credentials.

Affected Systems: Any Node.js application using Nodemailer before 9.0.1 that exposes mail-sending functionality to authenticated users — particularly those that render HTML content, support custom email templates, or allow user-supplied fields to flow into message construction.

Blast Radius: The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N indicates the attack is network-exploitable, requires low attack complexity, needs low-level (authenticated) privileges, needs no user interaction, does not cross trust boundaries, and has high confidentiality impact with low integrity impact and no availability impact. The lack of user interaction and the simplicity of the attack make this a viable target once authentication is obtained. EPSS score of 0.00254 (16.7th percentile) suggests exploitation is currently uncommon.

Detection Guidance

The following detection rules aim to identify exploitation attempts against this vulnerability. They are realistic heuristics given the available technical description, and should be tuned to the target environment.

Sigma Rule

title: Nodemailer Raw Option Sandbox Bypass - File/URL Reference in Outbound Email
id: 5f3b7c2a-9d6e-4a1b-8f2c-3e5d0a1b8c4d
status: experimental
description: Detects attempts to exploit CVE-2026-82659 by sending raw email messages with file or URL references to a Nodemailer application with disableFileAccess/disableUrlAccess enabled.
author: Valtersit Analytics
date: 2026/06/01
logsource:
    category: application
    product: nodemailer
    service: mail
    definition: 'Requires application logging of Nodemailer message options or raw email content.'
detection:
    selection_http_scheme:
        - 'message.raw': '*://*'
        - 'message.raw': '*file://*'
        - 'message.raw': '*http://*'
        - 'message.raw': '*https://*'
    selection_file_path:
        - 'message.raw': '*file:///*'
        - 'message.raw': '*/etc/*'
        - 'message.raw': '*C:\\*'
        - 'message.raw': '*/home/*'
        - 'message.raw': '*/proc/*'
        - 'message.raw': '*/root/*'
    condition: selection_http_scheme or selection_file_path
    timeframe: 5m
level: high
falsepositives:
    - Legitimate use of file or URL attachments in application-generated emails
    - Templates that legitimately embed remote images or content
fields:
    - source.ip
    - user
    - message.to
    - message.raw

YARA Rule

rule Nodemailer_RawOption_SandboxBypass_CVE_2026_82659
{
    meta:
        author = "Valtersit Analytics"
        date = "2026-06-01"
        description = "Detects Nodemailer raw message content containing file or URL references indicative of CVE-2026-82659 exploitation"
        cve = "CVE-2026-82659"
        severity = "high"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-82659"

    strings:
        $s1 = "disableFileAccess" ascii nocase
        $s2 = "disableUrlAccess" ascii nocase
        $s3 = "raw" ascii nocase
        $f1 = "file://" ascii nocase
        $f2 = "/etc/passwd" ascii nocase
        $f3 = "/proc/self/environ" ascii nocase
        $f4 = "C:\\Windows\\" ascii nocase
        $u1 = "http://" ascii nocase
        $u2 = "https://" ascii nocase
        $u3 = "169.254.169.254" ascii nocase

    condition:
        // Detects presence of URL or file reference alongside raw message context
        (any of ($f*) or any of ($u*)) and
        (uint16(0) == 0x0A0D or #s1 > 0 or #s2 > 0 or #s3 > 0)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-82659 Nodemailer Raw Option SSRF/File Disclosure Attempt"; flow:established,to_server; content:"raw"; http_client_body; nocase; pcre:"/file:\/\/|http:\/\/|https:\/\/|169\.254\.169\.254/i"; classtype:attempted-information-leak; reference:cve,2026-82659; sid:202682659; rev:1;)

Note: This rule assumes the exploit is delivered via an HTTP request to a web application that uses Nodemailer. Adjust ports and protocol (e.g., add alert smtp variants) based on network placement. Because the vulnerability triggers server-side (Nodemailer fetches the file/URL during message creation), network-level detection is best-effort and limited to the initial HTTP request containing the malicious raw parameter.

Elastic Detection

sequence by host.name with maxspan=5m
  [network where event.type == "start" and destination.port == 80 or destination.port == 443]
  [process where event.type == "start" and process.name == "node" and
     process.args : "*raw*" and
     (process.args : "*file://*" or process.args : "*http://*" or process.args : "*https://*" or process.args : "*169.254.169.254*")]
  [network where event.type == "start" and destination.port == 25 or destination.port == 587 or destination.port == 465]

Splunk SPL Query

index=web sourcetype=access_combined OR index=proxy
| where like(_raw, "%raw%") AND (like(_raw, "%file://%") OR like(_raw, "%http://%") OR like(_raw, "%https://%") OR like(_raw, "%169.254.169.254%"))
| eval threat = "CVE-2026-82659-Nodemailer-Sandbox-Bypass"
| table _time, src_ip, user, uri_path, http_method, _raw
| sort -_time

Wazuh OSSEC Rule

<group name="nodemailer,">

  <rule id="100826" level="12">
    <if_sid>100000</if_sid>
    <match>file://</match>
    <regex>raw</regex>
    <description>CVE-2026-82659: Nodemailer raw option with file:// reference detected - possible arbitrary file read attempt</description>
    <group>nodemailer,cve_2026_82659,attack_vector:exploit,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="100827" level="12">
    <if_sid>100000</if_sid>
    <match>http://</match>
    <regex>raw</regex>
    <description>CVE-2026-82659: Nodemailer raw option with HTTP URL reference detected - possible SSRF attempt</description>
    <group>nodemailer,cve_2026_82659,attack_vector:exploit,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="100828" level="12">
    <if_sid>100000</if_sid>
    <match>169.254.169.254</match>
    <regex>raw</regex>
    <description>CVE-2026-82659: Nodemailer raw option referencing cloud metadata IP - possible SSRF attempt</description>
    <group>nodemailer,cve_2026_82659,attack_vector:exploit,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED) — a single source (OSV) claims a fix exists in Nodemailer 9.0.1, but this has not been independently confirmed by a second source or a vendor advisory. Validate the fix in your own environment before relying on it.

1. Immediate Mitigations:

   • If you cannot upgrade immediately, restrict the use of the raw message option. Audit application code to ensure no user-supplied content is ever passed to the raw field. Where possible, sanitize or validate any URL/file inputs used in email composition.
   • Apply strict egress filtering on the application server to block outbound SMTP traffic to non-approved destinations. This limits the exfiltration channel.
   • Run the mail-sending process under a low-privileged OS account with minimal filesystem access. Restrict readable paths to only those required for application functionality (e.g., using OS-level directory permissions).
   • Use a reverse proxy or WAF to inspect HTTP requests to mail-sending endpoints for patterns matching file://, internal IP ranges, or cloud metadata addresses.
   • Monitor SMTP logs for unexpected outbound emails containing attached content fetched from local file paths or internal URLs.

2. Patch/Upgrade Steps:

   • Upgrade Nodemailer to version 9.0.1 or later — the claimed patched version.
   • Verify the upgrade by reviewing Nodemailer's changelog and confirming the fix addresses disableFileAccess/disableUrlAccess enforcement on the raw path.
   • Perform regression testing on all email functionality after upgrade.
   • Since patch confidence is low (2/4), consider subscribing to OSV and the Node.js security mailing list for further advisories, and independently test the behavior described in the CVE against the patched version.

3. Long-Term Hardening:

   • Adopt a secure-by-design approach: never allow raw email message injection from user input. If complex email composition is required, use structured APIs that enforce the security flags internally.
   • Implement automated dependency scanning (e.g., Snyk, Dependabot, or OSS-Fuzz integration) to catch vulnerable versions at CI time.
   • Apply the principle of least privilege to application servers: run them in containers with read-only root filesystems and no network egress except through approved proxies.
   • Enable comprehensive application logging that captures email composition parameters (without sensitive content) for forensic analysis.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-82659
2. OSV Advisory (patch source): https://osv.dev/vulnerability/CVE-2026-82659
3. Nodemailer Project (official): https://nodemailer.com/
4. CWE-73 Reference: https://cwe.mitre.org/data/definitions/73.html
5. CISA KEV: Not listed (as of report date)

Threat Actor Activity: No known threat actor campaigns or in-the-wild exploitation of this CVE have been reported. EPSS score (0.00254) and the absence of PoC/exploit code suggest the vulnerability is not currently attracting attacker interest. However, the vulnerability class (sandbox bypass) has historically been targeted by APT groups when tooling becomes available; maintain monitoring per the detection rules above.