# Temporary Auth.js/Nodemailer risk exception

Status: accepted for private staging only; public production remains blocked.

- Affected packages: `next-auth@5.0.0-beta.32`, `@auth/core@0.41.3`, `@auth/prisma-adapter@2.11.3`, `nodemailer@8.0.11`.
- Advisory: `GHSA-p6gq-j5cr-w38f`.
- Severity: high.
- Affected range: Nodemailer `<=9.0.0`.
- Dependency paths: `next-auth -> @auth/core -> nodemailer` and `@auth/prisma-adapter -> @auth/core -> nodemailer`.
- Vulnerable behavior: Nodemailer's message-level `raw` option can bypass file/URL access protections.
- Compatibility finding: Nodemailer 9.0.3 is outside the current Auth.js peer range (`^7.0.7 || ^8.0.5`); no compatible patched Auth.js release is available in the current dependency set. A forced override was not adopted.
- Reachability: TokNext does not register Auth.js `EmailProvider`; application email call sites pass only fixed `from`, `to`, `subject`, `html` and `text` fields. No caller accepts `raw`, attachments, file paths or remote URLs.
- Mitigations: recipient/header validation, escaped templates, single-slash callback paths, server-only SMTP/Resend credentials, TLS 1.2, ports 465/587 only, `disableFileAccess`, `disableUrlAccess`, no attachment field, redacted mock logs and rate-limited email actions.
- Residual risk: a future dependency or call-site change could expose the vulnerable Nodemailer raw path; npm audit continues to report the advisory.
- Monitoring: run `npm audit --omit=dev`, `npm ls nodemailer`, and search email call sites during every dependency review; alert on a compatible patched Auth.js/Nodemailer chain.
- Owner: application security owner.
- Review date: 2026-08-27.
- Expiration: 2026-10-27 or the first compatible patched chain, whichever comes first.
- Reopen automatically when a patched compatible chain is available, an email call site accepts raw/attachments/URLs, or a provider error exposes credentials/tokens.

This exception does not claim zero vulnerabilities. It permits private staging validation only while OpenAI key rotation and live revalidation remain pending.