Nodemailer before version 8.0.9 does not enforce the disableFileAccess and disableUrlAccess options when normalizing messages in jsonTransport. Attackers who supply message content fields containing path or href values can cause the transport to read arbitrary local files or fetch arbitrary URLs, thereby bypassing the intended access controls. This results in disclosure of potentially sensitive information, such as configuration data or credentials, and the weakness is classified as CWE‑862: Unauthorized Access.

The vulnerability affects the nodemailer:nodemailer product for all platforms where the Nodemailer library is installed in a version older than 8.0.9. No additional version specifics are provided in the advisory; all releases before 8.0.9 are therefore vulnerable.

The CVSS base score of 5.3 indicates a moderate severity. An EPSS score is not available, so the exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, implying that no public exploits have been reported. Attackers would need to inject malicious JSON content into a message processed by a trusted application using nodemailer's jsonTransport, which is plausible if an attacker can influence the email payload or manipulate the application’s input handling. The result would be unauthorized file or URL access with potential to aid further attacks.