Security Sandbox Bypass in Nodemailer by Nodemailer
CVE-2026-92595

6MEDIUM

Key Information:

Vendor

Nodemailer

Status
Nodemailer
Vendor
CVE Published:
16 September 2026

What is CVE-2026-92595?

Nodemailer, an npm package, has a vulnerability in versions 9.1.0 and earlier where the sandbox options disableFileAccess and disableUrlAccess are not honored. When resolving message content through the public plugin API MailMessage.resolveContent(), it fails to enforce user-defined access controls, allowing untrusted message content to read arbitrary local files or make server-side HTTP(S) requests. This occurs due to normalization of missing options, leading to a potential bypass of the security measures intended to protect the application. Upgrading to version 9.1.1 mitigates this vulnerability.

Affected Version(s)

nodemailer 0 < 9.1.1

nodemailer 9.1.1

References

https://github.com/nodemailer/nodemailer/security/advisor...
vendor-advisory
https://www.vulncheck.com/advisories/nodemailer-before-9....
third-party-advisory

CVSS V4

Score:
6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Hcamael
.