Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-82660 · CVE overview and exploitation status

EUVD-2026-68438

GHSA-28mw-fm9r-fxjg

GHSA-wqvq-jvpq-h66f

cve-program · CVE-2026-82660

• https://github.com/nodemailer/nodemailer/security/advisories/GHSA-wqvq-jvpq-h66f
• https://www.vulncheck.com/advisories/nodemailer-jsontransport-bypasses-disablefileaccess-and-disableurlaccess

euvd · EUVD-2026-68438

• https://github.com/nodemailer/nodemailer/security/advisories/GHSA-wqvq-jvpq-h66f
• https://www.vulncheck.com/advisories/nodemailer-jsontransport-bypasses-disablefileaccess-and-disableurlaccess

nvd · CVE-2026-82660

• https://github.com/nodemailer/nodemailer/security/advisories/GHSA-wqvq-jvpq-h66f
• https://www.vulncheck.com/advisories/nodemailer-jsontransport-bypasses-disablefileaccess-and-disableurlaccess

osv · GHSA-wqvq-jvpq-h66f

• https://github.com/nodemailer/nodemailer/security/advisories/GHSA-wqvq-jvpq-h66f
• https://github.com/nodemailer/nodemailer

No related changes are available here.