{"action":"Upgrade nodemailer to 9.1.1 or later.","affected":[{"fixed":"9.1.1","introduced":"0"}],"component":"nodemailer","cve_ids":["CVE-2026-92595"],"ecosystem":"npm","epss":0.00295,"exploited":false,"fixed_versions":["9.1.1"],"ghsa_id":"GHSA-8m3c-c648-2xjj","id":"tcs_01M5KFDD7E6YVQDNJ2AJ1AZT96","modified_at":"2026-09-17T11:56:00.648821018Z","published_at":"2026-09-08T21:16:00Z","references":["https://osv.dev/vulnerability/GHSA-8m3c-c648-2xjj","https://github.com/nodemailer/nodemailer/security/advisories/GHSA-8m3c-c648-2xjj","https://github.com/nodemailer/nodemailer/commit/ab7ef348b9a97b1fd70e7bfbeb56d4ea4a07946b","https://github.com/nodemailer/nodemailer/commit/dc48ed395c4d6c79ee5c95eb6eff17bafe391474","https://github.com/nodemailer/nodemailer","https://github.com/nodemailer/nodemailer/releases/tag/v9.1.1"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-8m3c-c648-2xjj","url":"https://osv.dev/vulnerability/GHSA-8m3c-c648-2xjj"}],"summary":"Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature"}