{
  "cveId": "CVE-2026-92595",
  "url": "https://patchblox.com/security/cve/CVE-2026-92595",
  "summary": "CVE-2026-92595 is fixed in node-nodemailer on 1 platform by DEBIAN-CVE-2026-92595 (version 10.0.0\u002B~8.0.1-1), released September 18, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "node-nodemailer: Nodemailer (npm package \u0060nodemailer\u0060) versions 9.1.0 and earlier do not honor the \u0060disableFileAccess\u0060 and \u0060disableUrl...",
  "description": "Nodemailer (npm package \u0060nodemailer\u0060) versions 9.1.0 and earlier do not honor the \u0060disableFileAccess\u0060 and \u0060disableUrlAccess\u0060 sandbox options when message content is resolved through the public plugin API \u0060MailMessage.resolveContent()\u0060 using the documented legacy three-argument signature \u0060resolveContent(data, key, callback)\u0060. Because \u0060shared.resolveContent()\u0060 normalizes the missing \u0060options\u0060 argument to an empty object, the message-level flags copied into \u0060mail.data\u0060 by the MailMessage constructor are discarded, and \u0060resolveContentValue()\u0060 skips both access-control checks, reaching \u0060nmfetch(url)\u0060 or \u0060fs.createReadStream(path)\u0060. As a result, plugin or application code that resolves untrusted message content (html, text, attachment \u0060path\u0060 or \u0060href\u0060) via this API can be induced to read arbitrary local files or issue outbound HTTP(S) requests (server-side request forgery), bypassing the sandbox the application enabled. The internal paths used by \u0060transporter.sendMail()\u0060 (\u0060resolveAll()\u0060, \u0060_convertDataImages()\u0060, and the MIME streaming path) are not affected. Fixed in version 9.1.1.",
  "published": "2026-09-16T22:18:30Z",
  "severity": "",
  "epss": 0.00295,
  "epssPercentile": 0.22345,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "node-nodemailer",
      "release": "Debian 14",
      "fixedVersion": "10.0.0\u002B~8.0.1-1",
      "fix": "DEBIAN-CVE-2026-92595",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-92595",
      "released": "2026-09-18T18:19:38Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}