nodemailer before 9.0.1 does not apply the disableFileAccess and disableUrlAccess flags to message-level raw options. This oversight allows an authenticated attacker to craft raw messages that include file paths or URLs, causing the library to read arbitrary files from the local filesystem or fetch data from arbitrary HTTP(S) endpoints. The leaked file contents or fetched data are then included in the outgoing message and sent to an attacker‑controlled recipient, compromising confidentiality and enabling server‑side request forgery.

nodemailer versions earlier than 9.0.1 on any platform that uses the SMTP sending functionality. The vulnerability is tied to the use of the raw option in authenticated message construction.

The CVSS score of 7.1 indicates a moderate to high severity. The EPSS score is less than 1%, indicating a very low but nonzero exploitation probability, and the vulnerability is not listed in CISA KEV. Attackers would need legitimate credentials for the application or service that uses nodemailer to send emails, then supply a crafted raw message. Once the bypass is achieved, an attacker can read any file with permission to the nodemailer process or perform SSRF against internal resources, potentially exposing sensitive information or opening further pivot opportunities.