Server-side Request Forgery (SSRF) Affecting nodemailer package, versions <9.1.1
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-NODEMAILER-19651820
- published9 Sept 2026
- disclosed8 Sept 2026
- creditHcamael
Introduced: 8 Sep 2026
New CVE NOT AVAILABLE CWE-73 (opens in a new tab)How to fix?
Upgrade nodemailer to version 9.1.1 or higher.
Overview
nodemailer is an Easy as cake e-mail sending from your Node.js applications
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the resolveContent() method in lib/mailer/mail-message.js. An attacker can read local files or trigger outbound URL fetches by supplying html or attachment content that is resolved through the legacy mail.resolveContent(data, key, callback) signature. When a plugin or application calls this API on a message created with disableFileAccess or disableUrlAccess, the access policy is dropped and the content resolver reaches fs.createReadStream() or nmfetch(), exposing server files or causing SSRF.