GHSA-wqvq-jvpq-h66f
MediumSummary
A vulnerability in Nodemailer allows bypassing the `disableFileAccess` and `disableUrlAccess` options when using `jsonTransport`. While the normal MIME streaming path enforces these restrictions, `jsonTransport` serializes the message in a way that bypasses them, potentially enabling access to local files or external URLs.
Risk Assessment
The organization may be at risk of sensitive data leakage if an attacker exploits this vulnerability to read local files or send requests to external servers, potentially leading to data breaches.
Recommendation
It is recommended to immediately update Nodemailer to the latest version that includes a fix for this vulnerability. Also, avoid using `jsonTransport` with untrusted input until the patch is applied.
Original NVD description (English source)
### Summary Nodemailer's `disableFileAccess` and `disableUrlAccess` options are intended to prevent message content and attachments from reading local files or fetching URLs. The normal MIME streaming path enforces those options in `MimeNode._getStream()`. However, `jsonTransport` serializes messag