CVE-2026-82660

5.3 mediumEPSS 0.3%

Medium (5.3). EPSS 0.3% chance of exploitation in the next 30 days. Fixed in nodemailer 8.0.9.

Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, bypassing intended access controls.

Severity

CVSS 4.0

5.3 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 17% of CVEs (scores of 2026-10-31)
CWE: CWE-862
Published: 2026-08-31
Modified: 2026-09-10
Record from: the NVD, synced 2026-10-19

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-wqvq-jvpq-h66f	npm	nodemailer	<8.0.9	8.0.9

References

https://github.com/nodemailer/nodemailer/security/advisories/GHSA-wqvq-jvpq-h66f
https://www.vulncheck.com/advisories/nodemailer-jsontransport-bypasses-disablefileaccess-and-disableurlaccess
https://github.com/nodemailer/nodemailer/security/advisories/GHSA-wqvq-jvpq-h66f

Check your stack JSON