CVE-2026-27492: Lettermint Node.js SDK Email Property Leakage Vulnerability
Summary
CVE-2026-27492: Lettermint Node.js SDK leaks email properties to unintended recipients when client instance is reused. Affects lettermint versions < 1.5.1. Fixed in 1.5.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Lettermint is a Node.js SDK designed for sending emails through its API. It provides developers with an easy way to integrate email functionalities into their applications, supporting features such as sending HTML and plain text emails, managing attachments, and handling recipient lists. However, a significant vulnerability exists in the way the SDK manages email properties when a single client instance is reused across multiple send operations.
Vulnerability Detail
The vulnerability arises from the failure to reset email properties (like recipient addresses, subject lines, HTML content, text content, and attachments) between consecutive .send() calls when using a single client instance. This oversight can lead to unintended leakage of information, where details from a previous email can be sent to a new recipient, potentially compromising sensitive information and causing privacy breaches in applications that handle transactional emails, such as password resets or notifications.
How To Fix
Minimum fixed version
1.5.1
This is the first release that contains the fix.
npm install lettermint@1.5.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, a temporary workaround is to instantiate a new client for each email send operation. This can be achieved with the following code snippet:
const client = new Lettermint({ apiKey: process.env.LETTERMINT_API_KEY });
await
client.email.to('recipient@example.com').subject('Subject Here').html('<p>Email content here</p>').send();
This approach guarantees that no state is carried over between sends.
Conclusion
The Lettermint Node.js SDK vulnerability (CVE-2026-27492) poses a risk of email property leakage when a single client instance is reused for multiple sends. Users are advised to upgrade to version 1.5.1 or later to mitigate this risk. In the meantime, instantiating a new client for each send operation serves as a viable workaround.
See every vulnerability recorded for lettermint →
FAQ
The vulnerability allows email properties to leak between different send operations when a single client instance is reused, potentially exposing sensitive information.
If your application uses the Lettermint SDK and reuses a client instance for sending emails, it may be affected by this vulnerability.
You can instantiate a new client for each email send operation as a temporary workaround to prevent information leakage.
The CVSS score for this vulnerability is 4.7, indicating a moderate severity level.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
