CVE-2026-92595

A flaw was found in Nodemailer. Plugin or application code that resolves untrusted message content through the MailMessage.resolveContent API using its legacy three-argument signature can bypass intended sandbox restrictions. This vulnerability allows an attacker to read arbitrary local files or...