CVE-2026-82660

Executive Summary

CVE-2026-82660 is an access-control bypass vulnerability in Nodemailer versions prior to 8.0.9 that permits authenticated attackers to bypass the disableFileAccess and disableUrlAccess configuration options during message normalization in the jsonTransport transport path. The flaw allows threat actors to read arbitrary local files from the mail server host or fetch arbitrary URLs by injecting path or href values into message content fields. The vulnerability is classified with a CVSS score of 5.4 (Medium) and maps to CWE-862 (Missing Authorization). Any application using Nodemailer's jsonTransport with disabled file/URL access controls — typically to sandbox the library — is affected. The impact is limited to low confidentiality and low integrity per the CVSS vector, but it can result in local file disclosure and server-side request forgery (SSRF) on the hosting system.

Technical Analysis

Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in the jsonTransport transport. The vulnerability class is a missing authorization check (CWE-862): the library intended to provide a security boundary by preventing Nodemailer from reading local files or fetching remote URLs through its message-building APIs. However, when jsonTransport is used, the code path that processes message content fields does not consult these two security flags.

The attack mechanism hinges on Nodemailer's message normalization routine. When constructing an email, Nodemailer allows certain message content fields to contain path or href attributes. Normally, the library uses these attributes to attach files by reading their contents (via the path attribute) or to embed remote resources by fetching the URL (via the href attribute). The disableFileAccess and disableUrlAccess options exist to disable these behaviors in restricted environments.

In vulnerable versions, the jsonTransport path bypasses the conditional checks that gate these options. As a result, if an attacker can influence the raw JSON message object passed to jsonTransport (e.g., by passing user-supplied input to a message template or by exploiting another injection point), they can set path to a local file (e.g., /etc/passwd) or href to an internal URL. During message normalization, Nodemailer will read the file or fetch the URL without verifying that the corresponding access flag is disabled.

No specific code-level function names or API parameters beyond disableFileAccess, disableUrlAccess, jsonTransport, path, and href are disclosed in the NVD description. It is important to note that the vulnerability is not a remote code execution (RCE) primitive; it is an access-control bypass that yields arbitrary local file reads and SSRF within the context of the process hosting the Node.js application.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-82660; the following attack chain is inferred from the vulnerability class and the NVD description.

1. Reconnaissance/Target Identification: An attacker must first identify a Node.js application using Nodemailer 8.0.0–8.0.8 that instantiates jsonTransport with either disableFileAccess: true or disableUrlAccess: true (or both). This may be discovered via banner grabbing, reading public GitHub configuration files, or analyzing error messages that reveal the transport type.

2. Triggering the Flaw: The attacker needs a way to influence message content fields in an email created via jsonTransport. Common entry points include web forms that generate automated emails (e.g., password reset, order confirmation), API endpoints that accept email template data, or any endpoint where user-controlled JSON becomes the Nodemailer message object without strict sanitization. The attacker supplies a message field that contains {"path": "/etc/shadow"} (for file read) or {"href": "http://169.254.169.254/latest/meta-data/"} (for SSRF) in a content slot that Nodemailer's message normalization processes.

3. Payload/Execution: Since the flaw is in message normalization, no special crafting beyond setting the path or href key is required. Nodemailer reads the local file or fetches the URL and either attaches the file content to the email or embeds the fetched resource, ultimately delivering it to the recipient address controlled by the attacker or making it available in the JSON output of the transport.

4. Post-Exploitation Impact: The attacker gains access to local file contents (e.g., configuration files, credentials, secrets) and can perform SSRF against internal network resources, bypassing firewalls and network segmentation. The confidentiality impact is low per the CVSS score because exfiltration is indirect (limited to file contents that can be attached to outgoing mail or embedded in response data), and integrity impact is low because the attacker can only cause the library to produce a modified message output, not alter server-side logic directly.

Impact Assessment

The business impact of CVE-2026-82660 is moderate but nontrivial. Applications using Nodemailer in an email notification or messaging pipeline are prime targets. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) shows that the attacker requires low-privilege access (authentication to the application or the ability to influence a message-building endpoint), no user interaction, and no required special conditions. The scope is unchanged (U), meaning exploitation affects only the vulnerable component, not adjacent systems directly.

Blast radius: File disclosure can expose application secrets (database credentials, API keys, private keys), and SSRF can reach internal cloud metadata endpoints (e.g., AWS EC2 metadata at 169.254.169.254) or internal management interfaces. Despite the low confidentiality and integrity subscores, the practical impact in a containerized or cloud environment can be significant. The EPSS score of 0.00189 (8.6th percentile) indicates that exploitation in the wild is currently rare, and the CISA KEV catalog does not list this CVE as a known exploited vulnerability.

Affected systems: Any Node.js service running Nodemailer 8.0.0–8.0.8 that uses the jsonTransport transport. Standard smtpTransport and sendmailTransport implementations are not affected because the flaw is specific to jsonTransport's message normalization path. The OSV package listing shows the vulnerable range as < 8.0.9 under the / package identifier, confirming all prior 8.x versions are affected.

Detection Guidance

Detection of exploitation attempts for CVE-2026-82660 involves looking for evidence of file-access or URL-fetch primitives being activated in a Nodemailer context.

Sigma Rule

title: Nodemailer jsonTransport File/URL Access Bypass Attempt
id: c2d7107b-1f5c-4a4e-9f2e-3b7a37d4a8f0
status: experimental
description: Detects attempts to exploit CVE-2026-82660 by identifying suspicious path or href fields in Node.js application logs or error messages involving Nodemailer jsonTransport.
logsource:
  category: application
  product: nodejs
detection:
  selection:
    message|contains:
      - 'jsonTransport'
      - 'disableFileAccess'
      - 'disableUrlAccess'
    path_field:
      - 'path":"'
      - 'path="'
    href_field:
      - 'href":"'
      - 'href="'
  filter_known_good:
    message|contains:
      - 'template'
      - 'static'
  condition: selection and not filter_known_good
level: medium
tags:
  - attack.t1190
  - cve.2026.82660

YARA Rule

rule Nodemailer_CVE_2026_82660_Filename_Detection {
    meta:
        author = "Valtersit Threat Intelligence"
        date = "2026-01-01"
        description = "Detects source code or configuration strings referencing vulnerable Nodemailer jsonTransport patterns"
        cve = "CVE-2026-82660"
        severity = "medium"
    strings:
        $a = "disableFileAccess" ascii wide
        $b = "disableUrlAccess" ascii wide
        $c = "jsonTransport" ascii wide
        $d = /path[\s]*[\"\']\s*:\s*[\"\']\/[a-z]/ ascii wide
        $e = /href[\s]*[\"\']\s*:\s*[\"\']https?:\/\// ascii wide
    condition:
        (any of ($a,$b)) and any of ($c,$d,$e)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-82660 Nodemailer jsonTransport SSRF Attempt Detected"; flow:established,to_server; content:"path"; http_uri; nocase; content:"/etc/"; http_uri; nocase; sid:20268266001; rev:1; reference:cve,CVE-2026-82660; metadata:created_at 2026_01_01, updated_at 2026_01_01;)
alert http any any -> any any (msg:"CVE-2026-82660 Nodemailer jsonTransport File Read Attempt"; flow:established,to_server; content:"href"; http_uri; nocase; content:"169.254.169.254"; http_uri; nocase; sid:20268266002; rev:1; reference:cve,CVE-2026-82660; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

sequence by host.name with maxspan=1m
  [file where process.executable : ("*node*", "*npm*") and
     (file.path : "/etc/*" or file.path : "/proc/*") and
     file.name : ("passwd", "shadow", "environment")]
  [process where wildcard(process.command_line, "*disableFileAccess*") or wildcard(process.command_line, "*jsonTransport*")]

Splunk SPL Query

index=* sourcetype=nodejs OR sourcetype=json
| search "jsonTransport" AND ("disableFileAccess" OR "disableUrlAccess")
| regex _raw="(path|href)\W+[\"']?(/etc/|https?://|file://)"
| table _time, host, source, message
| eval severity = "high"
| where severity == "high"

Wazuh OSSEC Rule

<group name="cve-2026-82660,">
  <rule id="845853" level="10">
    <decoded>jsonTransport</decoded>
    <match>disableFileAccess|disableUrlAccess</match>
    <regex>path[[:space:]]*[=:][[:space:]]*"/etc/|href[[:space:]]*[=:][[:space:]]*"https?://</regex>
    <description>CVE-2026-82660: Nodemailer jsonTransport access control bypass attempt observed</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve-2026-82660,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 2/4 (CLAIMED): a single source (OSV package tracker) claims a patch exists in version 8.0.9, but this is not independently confirmed by the vendor (Nodemailer's official advisory is not yet available).

1. Immediate Mitigations:

   • Upgrade to Nodemailer 8.0.9 or later. Perform this immediately if your application uses jsonTransport.
   • If upgrading is not immediately possible, temporarily switch the transport to smtpTransport or sendmailTransport, which are not affected by this flaw.
   • Audit all message-building code paths to ensure that user-controlled input can never populate path or href fields in the JSON message object passed to Nodemailer. Implement an explicit allowlist of permitted content field keys.

2. Patch/Upgrade Steps:

   • Run npm audit in your Node.js application directory to identify the vulnerable Nodemailer version.
   • Run npm install nodemailer@^8.0.9 to upgrade to the claimed fixed version.
   • After upgrading, verify integrity with npm ci and run your test suite, particularly any tests that populate disableFileAccess and disableUrlAccess options to ensure they are enforced.

3. Long-Term Hardening:

   • Add a regression test that instantiates jsonTransport with disableFileAccess: true and disableUrlAccess: true and attempts to send a message with path and href fields; assert that the library throws an error or ignores those fields.
   • In production, run your Node.js application in a sandboxed container with restricted filesystem access (read-only root filesystem where possible) and egress network filtering to mitigate the impact of any future SSRF or file-read primitives.
   • Subscribe to the Nodemailer GitHub repository's security advisories for the official patch confirmation when vendor publishes it.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-82660
2. OSV Package Advisory for Nodemailer (claimed fix in 8.0.9): https://osv.dev/vulnerability/CVE-2026-82660
3. Nodemailer GitHub Repository (main project — check for release notes of v8.0.9): https://github.com/nodemailer/nodemailer
4. Nodemailer npm package page (for version history): https://www.npmjs.com/package/nodemailer
5. CISA Known Exploited Vulnerabilities Catalog (for confirmation that this CVE is NOT listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence have been reported for this CVE as of the writing of this report.