CVE-2026-92595 Nodemailer before 9.1.1 Security Sandbox Bypass via resolveContent
Attackers can bypass sandbox restrictions in Nodemailer to read local files or perform SSRF via the resolveContent API.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-92595?
CVE-2026-92595 is a medium-severity server-side request forgery vulnerability in nodemailer, published on 16 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Nodemailer (npm package `nodemailer`) versions 9.1.0 and earlier do not honor the `disableFileAccess` and `disableUrlAccess` sandbox options when message content is resolved through the public plugin API `MailMessage.resolveContent()` using the documented legacy three-argument signature `resolveContent(data, key, callback)`. Because `shared.resolveContent()` normalizes the missing `options` argument to an empty object, the message-level flags copied into `mail.data` by the MailMessage constructor are discarded, and `resolveContentValue()` skips both access-control checks, reaching `nmfetch(url)` or `fs.createReadStream(path)`. As a result, plugin or application code that resolves untrusted message content (html, text, attachment `path` or `href`) via this API can be induced to read arbitrary local files or issue outbound HTTP(S) requests (server-side request forgery), bypassing the sandbox the application enabled. The internal paths used by `transporter.sendMail()` (`resolveAll()`, `_convertDataImages()`, and the MIME streaming path) are not affected. Fixed in version 9.1.1.
Weakness: CWE-73
Which versions are affected by CVE-2026-92595?
2 open source packages ship an affected version, including nodemailer.
| Package | Affected | Fixed in |
|---|---|---|
nodemailer npm | All versions | 9.1.1 |
nodemailer npm | All versions | 9.1.1 |
How do I fix CVE-2026-92595?
Upgrade nodemailer to 9.1.1 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-92595 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-92595 exists.
Sources
Also known as CLEANSTART-2026-MI57025, CLEANSTART-2026-VQ15547, CLEANSTART-2026-YT99310, CLSA-2026-1788978110, CLSA-2026-1790109128, DEBIAN-CVE-2026-92595 and 20 more.