CVE-2026-92595

Executive Summary

CVE-2026-92595 is a sandbox-bypass vulnerability in the npm package nodemailer (versions 9.1.0 and earlier) in which the disableFileAccess and disableUrlAccess access-control flags are silently ignored when message content is resolved through the public plugin API MailMessage.resolveContent() using the documented legacy three-argument signature resolveContent(data, key, callback). Applications and plugins that resolve untrusted message content (such as html, text, or attachment path/href values) through this API can be induced to read arbitrary local files or make outbound HTTP(S) requests, defeating the sandbox the application explicitly enabled. The vulnerability is assessed at CVSS 3.1 base score 5.9 (Medium), with High confidentiality impact and Low integrity impact.

Technical Analysis

Nodemailer provides disableFileAccess and disableUrlAccess options intended to act as a security sandbox: when set, the library should refuse to read content from the local filesystem or fetch content over the network while processing message data. Those protections are enforced inside the internal content-resolution pipeline.

The flaw resides in the interaction between the public plugin API MailMessage.resolveContent() and the internal helper shared.resolveContent(). When a caller uses the documented legacy three-argument signature resolveContent(data, key, callback), no options argument is supplied. Internally, shared.resolveContent() normalizes the missing options argument to an empty object {}. The message-level flags copied into mail.data by the MailMessage constructor are therefore discarded — they are not present on the empty object that the resolver actually consults.

With access-control context lost, resolveContentValue() skips both access-control checks (the file-access check and the URL-access check) and proceeds directly to the dangerous sinks: nmfetch(url) for URL-sourced content and fs.createReadStream(path) for local file-sourced content. Because the checks are bypassed rather than merely misconfigured, a caller-supplied path or href value in message data is acted upon without the sandbox ever being consulted.

Crucially, the NVD description states that the internal paths used by the normal send flow — transporter.sendMail() via resolveAll(), _convertDataImages(), and the MIME streaming path — are not affected. The vulnerability is reachable only when application or plugin code invokes the public resolveContent() API with the legacy three-argument signature, making this an API-misuse-adjacent defect in which the safe-looking public contract diverges from the sandbox guarantees the developer expects.

The root cause maps to CWE-73 (External Control of File Name or Path): externally influenced input (message content keys such as path or href) is used to select a local file or remote resource without effective validation, because the validation state was dropped by argument normalization.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for CVE-2026-92595. The following chain is inferred strictly from the vulnerability class and the details in the NVD description.

1. Reconnaissance / target identification. An attacker identifies a Node.js application that uses nodemailer (<= 9.1.0) and that (a) has enabled the disableFileAccess and/or disableUrlAccess sandbox options, and (b) resolves untrusted message content through a plugin or application code path that calls the public MailMessage.resolveContent() API with the legacy three-argument signature resolveContent(data, key, callback). Public code search for that call signature, plus package manifests pinning nodemailer <= 9.1.0, would inform targeting.

2. Triggering the flaw class. The attacker supplies message content in which a relevant content key (html, text, or an attachment path or href) is attacker-controlled. That value is later passed into resolveContent(data, key, callback) by the vulnerable application or plugin. Because shared.resolveContent() normalizes the missing options argument to {}, the message-level disableFileAccess/disableUrlAccess flags copied into mail.data by the MailMessage constructor are discarded, and resolveContentValue() performs no access-control checks before proceeding.

3. Payload / execution at the vulnerability-class level. Two sink classes are reached depending on the value type supplied:

   • A local filesystem path reaches fs.createReadStream(path), causing arbitrary local file reads subject only to the process's file permissions.
   • A URL reaches nmfetch(url), causing an outbound HTTP(S) request — server-side request forgery (SSRF) — from the application server. No specific payload strings, code patterns, or additional API parameters beyond those named in the NVD description are asserted here, as no PoC is public.

4. Post-exploitation impact. Successfully read local file content may be incorporated into message content and subsequently exfiltrated through the application's normal email or rendering output. The SSRF primitive enables outbound requests to attacker-chosen or internal-only endpoints, supporting internal network reconnaissance, interaction with unauthenticated internal services, or use of the mail server host as a request pivot. The attacker does not gain code execution directly; confidentiality is the primary casualty, with minor integrity exposure from what is disclosed or transmitted.

The 'High' attack complexity in the CVSS vector reflects the prerequisite that the vulnerable public API path be used by application or plugin code with the legacy signature and that attacker-influenced content be routed through it, rather than an exploitation step the attacker must overcome technically.

Impact Assessment

The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N, base score 5.9 (Medium):

• AV:N (Network) — the attacker need not be adjacent to the vulnerable service; the attack is delivered over the network via crafted message content.
• AC:H (High) — exploitation depends on a specific, non-default code path: the application or plugin must call resolveContent() with the legacy three-argument signature and must pass attacker-influenced content into it.
• PR:L (Low) — the attacker needs only low-privileged or ordinary ability to influence message content reaching the vulnerable API.
• UI:N (None) — no user interaction is required.
• S:U (Unchanged) — the impact is scoped to the vulnerable component.
• C:H (High) — arbitrary local file reads and outbound SSRF requests are the core impact.
• I:L (Low) — limited integrity exposure via content that is read or fetched and subsequently used.
• A:N (None) — no direct availability impact is described.

Affected systems. Any Node.js application or plugin ecosystem built on nodemailer 9.1.0 or earlier that both enables the disableFileAccess/disableUrlAccess sandbox and resolves untrusted content through the public legacy resolveContent() signature. The blast radius includes the confidentiality of local files readable by the application process and the reachability of internal-only network services from the mail-sending host. Applications using only transporter.sendMail() and its internal resolveAll(), _convertDataImages(), and MIME streaming paths are explicitly outside the affected surface.

Sandbox-trust angle. The most serious business consideration is that the control an application explicitly enabled is silently defeated, so operators who configured the sandbox per documentation may hold a false sense of safety and may have under-scoped compensating controls such as network egress filtering or filesystem isolation.

Detection Guidance

Detection focuses on the observable sinks — unexpected fs.createReadStream reads of sensitive paths and unexpected outbound HTTP(S) requests from the mail-sending process — since the vulnerability leaves no dedicated log signature. The rules below are behavioral and must be tuned to the environment.

Sigma Rule

title: Nodemailer Sandbox Bypass via resolveContent Legacy Signature (CVE-2026-92595)
id: 8f3c1a52-7d4e-4b91-b6a2-1c0e5f9a2d10
status: experimental
description: Detects anomalous local file reads or outbound HTTP(S) fetches by Node.js
  processes hosting nodemailer, consistent with abuse of MailMessage.resolveContent()
  with the legacy three-argument signature that bypasses disableFileAccess and
  disableUrlAccess on nodemailer versions 9.1.0 and earlier.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-92595
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - cve.2026-92595
logsource:
  category: process_creation
  product: linux
detection:
  selection_proc:
    Image|endswith:
      - '/node'
      - '/nodejs'
  selection_cmd:
    CommandLine|contains:
      - 'nodemailer'
  selection_net_or_fs:
    CommandLine|contains:
      - 'createReadStream'
      - 'nmfetch'
  condition: selection_proc and (selection_cmd or selection_net_or_fs)
falsepositives:
  - Legitimate nodemailer use reading template files for transactional email
  - Applications fetching remote images for MIME embedding
level: medium

YARA Rule

rule CVE_2026_92595_Nodemailer_ResolveContent_Sandbox_Bypass
{
    meta:
        description = "Detects nodemailer source or bundle artifacts where the public resolveContent three-argument signature and the disableFileAccess/disableUrlAccess sandbox flags co-exist in versions prior to 9.1.1, indicating exposure to CVE-2026-92595"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-92595"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $api        = "resolveContent" ascii
        $legacy_sig = "resolveContent(data, key, callback)" ascii
        $shared     = "shared.resolveContent" ascii
        $value      = "resolveContentValue" ascii
        $fs_flag    = "disableFileAccess" ascii
        $url_flag   = "disableUrlAccess" ascii
        $sink_file  = "fs.createReadStream" ascii
        $sink_net   = "nmfetch" ascii
        $version    = /"version"\s*:\s*"9\.1\.0"/ ascii

    condition:
        filesize < 10MB and
        (
            ($api and $shared and $value) or
            ($legacy_sig and ($fs_flag or $url_flag)) or
            ($sink_file and $sink_net and $version)
        )
}

Suricata IDS Rule

Detects SSRF-style outbound requests where message content contains a URL being resolved; egress from mail-sending hosts should be constrained. Tune the dollar-home-net variable to your internal ranges.

alert http $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"CVE-2026-92595 Nodemailer resolveContent SSRF Outbound Fetch"; flow:to_server,established; http.method; content:"GET"; http.header; content:"User-Agent"; content:"node"; nocase; classtype:attempted-recon; reference:cve,2026-92595; metadata:created_at 2026_01_01, updated_at 2026_01_01; sid:202692595; rev:1;)

Elastic Detection

EQL query for Node.js processes spawning outbound network activity to non-approved destinations, indicating abuse of nmfetch via resolveContent().

process where process.name in ("node", "nodejs")
  and process.args != null
  and (
    process.args : "*nodemailer*"
    or process.args : "*resolveContent*"
    or process.args : "*createReadStream*"
  )

Splunk SPL Query

Detects Node.js processes opening outbound connections or reading sensitive sentinel files. Indexes depend on the endpoint or flow data source available in your deployment.

index=endpoint OR index=network (process_name=node OR process_name=nodejs)
  (command_line="*nodemailer*" OR command_line="*resolveContent*" OR command_line="*createReadStream*"
   OR http_user_agent="*node*")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(dest_ip) as dest_ips values(file_path) as files values(process_name) as procs
        by host, user
| where count > 0
| eval cve="CVE-2026-92595"
| table cve, host, user, procs, dest_ips, files, first_seen, last_seen

Wazuh OSSEC Rule

<group name="nodemailer,cve-2026-92595,">
  <rule id="100925" level="8">
    <decoded_as>json</decoded_as>
    <field name="process.name">node|nodejs</field>
    <match>nodemailer|resolveContent|createReadStream|nmfetch</match>
    <description>CVE-2026-92595: Possible nodemailer resolveContent sandbox bypass - Node.js process handling mail content with file/URL access sinks</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_92595,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists in any tracked source, and Affected Versions, OSV Packages, Vendor Fix, and Workarounds are all empty/N/A in the supplied data. The NVD description itself states the issue is fixed in version 9.1.1; verification against an authoritative vendor advisory and registry metadata is required before relying on that.

1) Immediate mitigations (apply while patch status is unverified):

• Audit application and plugin code for calls to the public MailMessage.resolveContent() API, particularly the legacy three-argument signature resolveContent(data, key, callback). Refactor callers to pass explicit options so that access-control context is not silently lost, or route content resolution through the unaffected internal send path.
• Treat all message content fields (html, text, attachment path, href) as untrusted. Do not allow external users to supply attachment path or href values that reach content resolution.
• Enforce egress filtering on mail-sending hosts to limit nmfetch(url) SSRF reachability, and constrain the filesystem namespace/read permissions of the Node.js process to reduce the value of arbitrary local file reads.
• Monitor for unexpected outbound connections and reads of sensitive paths from mail-sending processes using the detection rules above.

2) Patch/upgrade steps:

• Upgrade nodemailer to version 9.1.1 or later, which the NVD description identifies as the fixed release.
• Confirm the upgrade in lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml) and in deployed container images; verify no transitive copy of nodemailer <= 9.1.0 remains.
• Re-verify that the sandbox flags (disableFileAccess, disableUrlAccess) behave as intended after upgrading, given the API-level nature of the bypass.

3) Long-term hardening:

• Pin and continuously monitor dependency versions; track advisories for nodemailer and its plugin ecosystem.
• Adopt defense-in-depth so that no single library flag is the sole control preventing file read or SSRF — combine process-level filesystem isolation (containers, read-only mounts, least-privilege service accounts) with network egress allowlists.
• Standardize on explicit, current API signatures and deprecate legacy call forms in internal plugins to avoid silently dropped security options.
• Add regression tests asserting that sandbox options are honored whenever untrusted content is resolved.

References

• NVD — CVE-2026-92595: https://nvd.nist.gov/vuln/detail/CVE-2026-92595
• CWE-73 — External Control of File Name or Path: https://cwe.mitre.org/data/definitions/73.html
• Nodemailer npm package (verify version and advisory status): https://www.npmjs.com/package/nodemailer
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CVSS 3.1 Specification: https://www.first.org/cvss/v3.1/specification-document

Exploit-in-the-wild / campaign evidence: None. No public PoC, exploit code, or Nuclei template is available, and CISA KEV does not list this CVE. No EPSS score has been assigned. No threat actor campaigns are associated with CVE-2026-92595 in the supplied data.