Nodemailer 9.0.0 – File‑Read / SSRF Vulnerability Allows Bypass of “disableFileAccess” Flags
What Happened – A logic flaw in Nodemailer ≤ 9.0.0 lets an attacker supply a raw:{path} or raw:{href} option that reads arbitrary files or fetches arbitrary URLs, even when the application sets disableFileAccess:true and/or disableUrlAccess:true. The issue is tracked by GHSA‑p6gq‑j5cr‑w38f and was fixed in version 9.0.1.
Why It Matters for Compliance & Audit Readiness
- The flaw illustrates a gap between design‑time security controls (library‑level flags) and runtime enforcement, exactly the type of control‑mapping deficiency SOC 2 audits expect evidence for.
- Continuous evidence of library version management and automated control‑mapping to security policies helps demonstrate due diligence and a defensible audit trail.
- Verisq’s Control Mapping capability can automatically map library versions to required SOC 2 controls and collect continuous proof that mitigations (e.g., version upgrades) are in place.
Who Is Affected – SaaS platforms, email‑relay services, and any web application that embeds Nodemailer for outbound mail (technology‑focused firms, fintech, e‑commerce, health‑tech, etc.).
Recommended Actions
- Inventory all services that depend on Nodemailer ≤ 9.0.0 and upgrade to 9.0.1 or later.
- Map the “disableFileAccess/disableUrlAccess” control to your SOC 2 CC6.1 – Logical Access Controls and capture upgrade evidence in your continuous‑compliance system.
- Add version‑monitoring rules to your software‑bill‑of‑materials (SBOM) pipeline to flag future vulnerable releases.
Technical Notes – The vulnerability resides in MailComposer.compile() where the disableFileAccess and disableUrlAccess flags are not propagated to the root RFC822 node. Exploitation requires only local message composition; no network payload is needed. No CVE was assigned; the advisory is GHSA‑p6gq‑j5cr‑w38f. Source: Exploit‑DB 52654