Bug 2526190 (CVE-2026-82659)

Summary:	CVE-2026-82659 nodemailer: Nodemailer: Arbitrary file read and Server-Side Request Forgery via raw option bypass
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	abarbaro, alizardo, dschmidt, jchui, jhe, jlanda, kaycoth, kshier, ktsao, lchilton, nboldt, oaljalju, psrna, rhel-process-autobot, sfeifer, simaishi, stcannon, teagle, watson-tool-maintainers, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in nodemailer. Authenticated attackers can bypass security flags by crafting raw messages with specific file paths or URLs. This allows them to read arbitrary files from the system or perform Server-Side Request Forgery (SSRF), potentially leading to information disclosure or unauthorized access to internal network resources.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-31 09:04:03 UTC

nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbitrary files or perform server-side request forgery by supplying path or href properties. Attackers can exploit this by crafting raw messages with file paths or URLs that bypass the intended sandbox, with fetched content delivered in the outgoing message to attacker-controlled recipients.