CVE-2026-92595: Nodemailer SSRF Vulnerability

CVE-2026-92595 Overview

CVE-2026-92595 is a sandbox bypass vulnerability in Nodemailer, the widely used Node.js email library distributed as the nodemailer npm package. Versions 9.1.0 and earlier fail to honor the disableFileAccess and disableUrlAccess sandbox options when message content is resolved through the public plugin API MailMessage.resolveContent() using its legacy three-argument signature. Plugin or application code that passes untrusted message content through this API can be induced to read arbitrary local files or issue outbound HTTP(S) requests, producing server-side request forgery (SSRF) and local file disclosure. The issue is fixed in version 9.1.1.

Critical Impact
Attackers who influence message fields such as html, text, or attachment path/href can trigger arbitrary file reads and SSRF against internal services, bypassing sandbox flags the application explicitly enabled.

Affected Products

Nodemailer npm package versions 9.1.0 and earlier
Applications invoking MailMessage.resolveContent(data, key, callback) with the legacy three-argument signature
Plugins built on the Nodemailer plugin API that resolve untrusted message content

Discovery Timeline

2026-09-16 - CVE-2026-92595 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92595

Vulnerability Analysis

The flaw is an improper control of externally influenced resource identifiers [CWE-73] in Nodemailer's content resolution pipeline. The MailMessage constructor copies message-level sandbox flags such as disableFileAccess and disableUrlAccess into mail.data. These flags are intended to block file system reads and outbound URL fetches when Nodemailer resolves fields containing a path or href value.

When callers invoke the documented legacy three-argument form resolveContent(data, key, callback), the internal helper shared.resolveContent() normalizes the missing options argument to an empty object. The message-level sandbox flags are therefore discarded before resolveContentValue() performs its access-control checks. Both checks are skipped, and execution reaches nmfetch(url) for URL fetches or fs.createReadStream(path) for file reads.

The internal transporter.sendMail() paths, including resolveAll(), _convertDataImages(), and the MIME streaming path, propagate the flags correctly and are not affected. The exposure is limited to the public plugin API surface.

Root Cause

The root cause is an argument-normalization defect in shared.resolveContent(). When the legacy signature omits options, the helper synthesizes an empty object rather than inheriting the sandbox flags already present on mail.data. As a result, disableFileAccess and disableUrlAccess never reach the access-control branch inside resolveContentValue().

Attack Vector

Exploitation requires that plugin or application code pass attacker-influenced message content, such as an untrusted path or href in an html, text, or attachment field, into MailMessage.resolveContent() using the three-argument signature. An attacker who controls those fields can request arbitrary local files or force outbound HTTP(S) requests to internal endpoints, achieving SSRF and file disclosure despite the application enabling the sandbox flags.

No verified public exploit code is available. See the GitHub Security Advisory GHSA-8m3c-c648-2xjj and the VulnCheck Nodemailer Security Advisory for the maintainer's technical writeup.

Detection Methods for CVE-2026-92595

Indicators of Compromise

Unexpected fs.createReadStream calls originating from Node.js processes that host Nodemailer plugins, particularly reads of sensitive paths such as /etc/passwd, .env, or cloud metadata files.
Outbound HTTP(S) requests from the mail-sending service to internal RFC1918 ranges, 127.0.0.1, or cloud instance metadata endpoints such as 169.254.169.254.
Application or plugin logs showing calls to MailMessage.resolveContent() with message data derived from untrusted user input.

Detection Strategies

Perform a dependency inventory to enumerate applications running nodemailer at version 9.1.0 or earlier. npm ls nodemailer and software bill of materials scans surface vulnerable installs.
Grep source and plugin code for calls to resolveContent( using the three-argument callback form and flag any path where the data argument originates from HTTP request bodies, queues, or other untrusted producers.
Alert on Node.js processes making file-read syscalls to sensitive paths or issuing egress requests to internal-only network ranges.

Monitoring Recommendations

Instrument mail-sending services with runtime telemetry that records outbound HTTP destinations and file paths accessed, then baseline expected behavior.
Forward Node.js application logs, egress proxy logs, and endpoint telemetry into a centralized data lake so SSRF and file-disclosure attempts can be correlated across tiers.
Track deployments of the nodemailer package version across environments and alert on drift from 9.1.1 or later.

How to Mitigate CVE-2026-92595

Immediate Actions Required

Upgrade nodemailer to version 9.1.1 or later in every application and plugin that depends on it.
Audit application and plugin code for direct calls to MailMessage.resolveContent() and confirm that untrusted input is not passed through the legacy three-argument signature.
Validate and constrain any user-controlled path, href, html, or text fields before they reach Nodemailer, rejecting file:// URLs, absolute file paths, and internal hostnames.

Patch Information

The maintainers fixed the issue in Nodemailer 9.1.1 by ensuring that shared.resolveContent() inherits the message-level disableFileAccess and disableUrlAccess flags even when options is omitted from the legacy signature. Refer to the GitHub Security Advisory GHSA-8m3c-c648-2xjj for the commit-level fix and upgrade guidance.

Workarounds

If an immediate upgrade is not possible, refactor callers to use the four-argument form of resolveContent() and pass an explicit options object that sets disableFileAccess: true and disableUrlAccess: true.
Enforce network egress controls that block the mail-sending service from reaching internal address ranges and cloud metadata endpoints.
Run the Node.js process under a restrictive filesystem policy, such as a read-only container or AppArmor/SELinux profile, so that arbitrary file reads through fs.createReadStream are denied at the OS layer.

bash

# Upgrade Nodemailer to the patched release
npm install nodemailer@^9.1.1

# Verify the resolved version in the dependency tree
npm ls nodemailer