Duplicate Advisory: Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message
High severity
GitHub Reviewed
Published
Aug 31, 2026
to the GitHub Advisory Database
•
Updated Sep 2, 2026
Withdrawn
This advisory was withdrawn on Sep 2, 2026
Give feedback on Dependabot alerts