What is GHSA-28mw-fm9r-fxjg?

GHSA-28mw-fm9r-fxjg is a security advisory published by GitHub Security Advisories with Medium severity. Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during...

Which CVE IDs does GHSA-28mw-fm9r-fxjg cover?

GHSA-28mw-fm9r-fxjg covers the following CVE IDs: CVE-2026-82660. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-28mw-fm9r-fxjg?

GHSA-28mw-fm9r-fxjg has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

GHSA-28mw-fm9r-fxjgMediumCVSS 5.4

Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during...

Vendor

GitHub Security Advisories

Published

August 31, 2026

Last Modified

August 31, 2026

🔗 CVE IDs covered (1)

CVE-2026-82660 →

📋 Description

Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, bypassing intended access controls.

🔗 References (4)

https://github.com/nodemailer/nodemailer/security/advisories/GHSA-wqvq-jvpq-h66f
https://nvd.nist.gov/vuln/detail/CVE-2026-82660
https://www.vulncheck.com/advisories/nodemailer-jsontransport-bypasses-disablefileaccess-and-disableurlaccess
https://github.com/advisories/GHSA-28mw-fm9r-fxjg