CVE-2026-82660

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-82660

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82660.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-82660

Aliases

GHSA-wqvq-jvpq-h66f

Downstream

DEBIAN-CVE-2026-82660

Published

2026-08-31T08:46:25.605Z

Modified

2026-09-01T03:46:34.927640475Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess

Details

Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, bypassing intended access controls.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82660.json",
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-862"
    ]
}

References

Affected packages

Git / github.com/nodemailer/nodemailer

Affected ranges

Type

GIT

Repo

https://github.com/nodemailer/nodemailer

Events

Introduced

Fixed

07303cb0cb34b97b44856f5de3eff212b63e4567

Database specific

Show details

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "8.0.9"
        }
    ]
}

Affected versions

v0.*

v0.1

v0.1.1

v0.1.10

v0.1.12

v0.1.13

v0.1.14

v0.1.15

v0.1.16

v0.1.17

v0.1.19

v0.1.2

v0.1.20

v0.1.21

v0.1.22

v0.1.23

v0.1.24

v0.1.3

v0.1.4

v0.1.5

v0.1.6

v0.1.7

v0.1.8

v0.1.9

v0.2.0

v0.2.2

v0.2.3

v0.2.4

v0.3.0

v0.3.1

v0.3.10

v0.3.11

v0.3.12

v0.3.13

v0.3.14

v0.3.15

v0.3.16

v0.3.17

v0.3.18

v0.3.19

v0.3.2

v0.3.20

v0.3.21

v0.3.22

v0.3.25

v0.3.26

v0.3.27

v0.3.28

v0.3.29

v0.3.3

v0.3.30

v0.3.31

v0.3.32

v0.3.33

v0.3.34

v0.3.35

v0.3.37

v0.3.38

v0.3.39

v0.3.4

v0.3.40

v0.3.41

v0.3.42

v0.3.43

v0.3.44

v0.3.45

v0.3.5

v0.3.6

v0.3.7

v0.3.8

v0.3.9

v0.4.0

v0.4.1

v0.4.2

v0.4.3

v0.4.4

v0.5.0

v0.5.1

v0.5.11

v0.5.12

v0.5.13

v0.5.14

v0.5.15

v0.5.2

v0.5.3

v0.5.4

v0.5.5

v0.5.6

v0.5.7

v0.5.8

v0.5.9

v0.6.0

v0.6.1

v0.6.2

v0.6.3

v0.6.4

v0.6.5

v0.7.0

v0.7.1

v1.*

v1.0.0

v1.0.1

v1.0.2

v1.0.3

v1.0.4

v1.1.0

v1.1.1

v1.1.2

v1.10.0

v1.11.0

v1.2.0

v1.2.1

v1.2.2

v1.3.0

v1.3.1

v1.3.2

v1.3.3

v1.3.4

v1.4.0

v1.5.0

v1.6.0

v1.7.0

v1.8.0

v1.9.0

v2.*

v2.0.0

v2.1.0

v2.2.0

v2.2.1

v2.3.0

v2.3.1

v2.3.2

v2.3.2-gpgtest.0

v2.4.0

v2.4.1

v2.4.2

v2.5.0

v2.6.0

v2.6.1

v2.6.2

v2.6.3

v2.6.4

v2.7.0

v2.7.1

v2.7.2

v3.*

v3.0.0

v3.0.1

v3.0.2

v3.1.0

v3.1.1

v3.1.2

v3.1.3

v3.1.4

v3.1.5

v3.1.6

v3.1.7

v3.1.8

v4.*

v4.0.0

v4.0.1

v4.1.0

v4.1.1

v4.1.2

v4.1.3

v4.2.0

v4.3.0

v4.3.1

v4.4.0

v4.4.1

v4.4.2

v4.5.0

v4.6.0

v4.6.1

v4.6.2

v4.6.3

v4.6.4

v4.6.5

v4.6.6

v4.6.7

v4.6.8

v4.7.0

v5.*

v5.0.0

v5.0.1

v5.1.0

v5.1.1

v6.*

v6.0.0

v6.1.0

v6.1.1

v6.2.0

v6.2.1

v6.3.0

v6.3.1

v6.4.0

v6.4.1

v6.4.10

v6.4.11

v6.4.12

v6.4.13

v6.4.14

v6.4.15

v6.4.16

v6.4.17

v6.4.18

v6.4.2

v6.4.3

v6.4.4

v6.4.5

v6.4.6

v6.4.7

v6.4.8

v6.5.0

v6.6.0

v6.6.1

v6.6.3

v6.6.4

v6.6.5

v6.7.0

v6.7.1

v6.7.2

v6.7.3

v6.7.4

v6.7.5

v6.7.6

v6.7.7

v6.7.8

v6.8.0

v6.9.0

v6.9.1

v6.9.10

v6.9.13

v6.9.14

v6.9.15

v6.9.16

v6.9.2

v6.9.3

v6.9.4

v6.9.5

v6.9.6

v6.9.7

v6.9.8

v7.*

v7.0.10

v7.0.11

v7.0.12

v7.0.13

v7.0.5

v7.0.6

v7.0.7

v7.0.9

v8.*

v8.0.0

v8.0.1

v8.0.2

v8.0.3

v8.0.4

v8.0.5

v8.0.6

v8.0.7

v8.0.8

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82660.json"