CVE-2026-82659
HighAdvisory
Published 18 Jun 2026In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 7.1
- base score, highest
- EPSS
- 0.003
- 17th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 168
- of 17,781 indexed, latest versions
- Container images
- 152
- deployed by those charts
- Fix available
- 1 of 1
- affected package
Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message
Carried by container images the latest versions of 168 of 17,781 indexed charts deploy, on 152 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| nodemailernpm | 1.11.0, 2.7.2, 4.0.1, 4.6.8+45 more | 9.0.1 | 152 |
- OSV records
- GHSA-p6gq-j5cr-w38f
Charts affected
168 by stars
Container images carrying it
152 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| library/ | 2654b1e90413 | nodemailer | 9.0.1 | 1 |
| library/ | 29773d6be407 | nodemailer | 9.0.1 | 1 |
| library/ | 767230c0f263 | nodemailer | 9.0.1 | 1 |
| library/ | 77196da4b0df | nodemailer | 9.0.1 | 1 |
| library/ | 83f7bf209844 | nodemailer | 9.0.1 | 1 |
| library/ | a7a268bbfb7f | nodemailer | 9.0.1 | 1 |
| library/ | ac533a6988ee | nodemailer | 9.0.1 | 1 |
| library/ | 0172f1c538e7 | nodemailer | 9.0.1 | 1 |
| library/ | 04c0fc150f3a | nodemailer | 9.0.1 | 1 |
| library/ | c5781ba340ef | nodemailer | 9.0.1 | 1 |
| library/ | e2e2031c15be | nodemailer | 9.0.1 | 1 |
| linuxserver/ | 6108ed066d4a | nodemailer | 9.0.1 | 1 |
| louislam/ | 059b49d64739 | nodemailer | 9.0.1 | 1 |
| louislam/ | 0b55bcb83a1c | nodemailer | 9.0.1 | 1 |
| louislam/ | 3d632903e6af | nodemailer | 9.0.1 | 1 |
| louislam/ | 3e24e96c89ef | nodemailer | 9.0.1 | 1 |
| louislam/ | 4c364ef96aad | nodemailer | 9.0.1 | 1 |
| louislam/ | 91e963bfda56 | nodemailer | 9.0.1 | 1 |
| louislam/ | 96510915e6be | nodemailer | 9.0.1 | 1 |
| louislam/ | 9865163f92c1 | nodemailer | 9.0.1 | 1 |
| louislam/ | a4eab252e5a2 | nodemailer | 9.0.1 | 1 |
| louislam/ | a84767d7934f | nodemailer | 9.0.1 | 1 |
| louislam/ | bc6f244ecf27 | nodemailer | 9.0.1 | 1 |
| maildev/ | 180ef51f65ee | nodemailer | 9.0.1 | 1 |
| misskey/ | e08b7c478093 | nodemailer | 9.0.1 | 1 |
| moonrailgun/ | b528c8f8fcc4 | nodemailer | 9.0.1 | 1 |
| moreillon/ | d2ee0423b797 | nodemailer | 9.0.1 | 1 |
| n8nio/ | 761374d4eb84 | nodemailer | 9.0.1 | 1 |
| n8nio/ | 8b39ed5a2de9 | nodemailer | 9.0.1 | 1 |
| n8nio/ | a9195bc499a3 | nodemailer | 9.0.1 | 1 |
| n8nio/ | cfe2704ff858 | nodemailer | 9.0.1 | 1 |
| n8nio/ | dd171d45102a | nodemailer | 9.0.1 | 1 |
| netrisai/ | 6e865080e86c | nodemailer | 9.0.1 | 1 |
| nocodb/ | 6779a4ddedf2 | nodemailer | 9.0.1 | 1 |
| nocodb/ | d9516f0bf546 | nodemailer | 9.0.1 | 1 |
| nodered/ | 070643219ea2 | nodemailer | 9.0.1 | 1 |
| ohmyform/ | afe53f4acdb1 | nodemailer | 9.0.1 | 1 |
| openhab/ | 29dd2bac8c4b | nodemailer | 9.0.1 | 1 |
| outlinewiki/ | 494dfb9249a6 | nodemailer | 9.0.1 | 1 |
| polonel/ | 0cf6513f6fe3 | nodemailer | 9.0.1 | 1 |
| requarks/ | 8b5865a7386c | nodemailer | 9.0.1 | 1 |
| rocketadmin/ | 10955ef540b9 | nodemailer | 9.0.1 | 1 |
| shinobisystems/ | 3ca746937856 | nodemailer | 9.0.1 | 1 |
| shinobisystems/ | c2f5ce2e1067 | nodemailer | 9.0.1 | 1 |
| solidproject/ | ccc4acb7e9a1 | nodemailer | 9.0.1 | 1 |
| soulteary/ | ac2512fa6e39 | nodemailer | 9.0.1 | 1 |
| speckle/ | 49d10dcdfb91 | nodemailer | 9.0.1 | 1 |
| speckle/ | 4b6a0750d5aa | nodemailer | 9.0.1 | 1 |
| speckle/ | 52f8eabf5cea | nodemailer | 9.0.1 | 1 |
| speckle/ | 687f43ab16f3 | nodemailer | 9.0.1 | 1 |