Server-side Request Forgery (SSRF) Affecting org.webjars.npm:nodemailer package, versions [0,]
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JAVA-ORGWEBJARSNPM-17375139
- published18 Jun 2026
- disclosed18 Jun 2026
- credithepigtails
Introduced: 18 Jun 2026
CVE NOT AVAILABLE CWE-918 (opens in a new tab)How to fix?
A fix was pushed into the master branch but not yet published.
Overview
org.webjars.npm:nodemailer is an Easy as cake e-mail sending from your Node.js applications
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the message-level raw option bypassing disableFileAccess and disableUrlAccess flags. An attacker can access arbitrary local files or perform server-side request forgery by supplying crafted input to the raw field, which bypasses intended access restrictions and results in sensitive data being sent to an attacker-controlled recipient.