Lettermint Node.js SDK leaks email properties to unintended recipients when client instance is reused
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
Lettermint Node.js SDK is the official Node.js SDK for Lettermint. In versions 1.5.0 and below, email properties (such as to, subject, html, text, and attachments) are not reset between sends when a single client instance is reused across multiple .send() calls. This can cause properties from a previous send to leak into a subsequent one, potentially delivering content or recipient addresses to unintended parties. Applications sending emails to different recipients in sequence — such as transactional flows like password resets or notifications — are affected. This issue has been fixed in version 1.5.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| lettermint | lettermint-node | before 1.5.1 | 1.5.1 | Patch available | CNA |
| — | lettermint (npm) | before 1.5.1 | 1.5.1 | Patch available | GHSA-49pc-8936-wvfp |
- lettermint-node Vendorlettermint Affected before 1.5.1 Fixed in 1.5.1 Patch available CNA
- lettermint (npm) Vendor— Affected before 1.5.1 Fixed in 1.5.1 Patch available GHSA-49pc-8936-wvfp
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:lettermint:lettermint:*:*:*:*:*:node.js:*:* | before 1.5.1 | Vulnerable | lettermint |
- cpe:2.3:a:lettermint:lettermint:*:*:*:*:*:node.js:*:* Versions before 1.5.1 Vulnerable ·lettermint
Remediation
- Fix · CNA lettermint-node (lettermint) Fixed in 1.5.1
- Fix · GHSA-49pc-8936-wvfp lettermint (npm) Fixed in 1.5.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-27492
- 2026-10-03 Alias added: GHSA-49pc-8936-wvfp
References
Patch 1
Advisory 2
Sources
- CVE-2026-27492 · CVE Program
- CVE-2026-27492 · NVD
- FIRST EPSS
- GHSA-49pc-8936-wvfp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences