CVE-2026-27492 json
Lettermint Node.js SDK leaks email properties to unintended recipients when client instance is reused
published 8mo ago modified 4mo ago also GHSA-49pc-8936-wvfp , EUVD-2026-7708
- cvss
- 4.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 8%
- public exploits
- 0
- none known
Summary
Lettermint Node.js SDK is the official Node.js SDK for Lettermint. In versions 1.5.0 and below, email properties (such as to, subject, html, text, and attachments) are not reset between sends when a single client instance is reused across multiple .send() calls. This can cause properties from a previous send to leak into a subsequent one, potentially delivering content or recipient addresses to unintended parties. Applications sending emails to different recipients in sequence — such as transactional flows like password resets or notifications — are affected. This issue has been fixed in version 1.5.1.
Patch / fix
- npm lettermint 1.5.1
- lettermint lettermint 1.5.1
Is CVE-2026-27492 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 8mo ago
Exploit prediction
0.19% chance of exploitation in the next 30 days, higher than 8% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.7 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 4.7 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | lettermint | <1.5.1 |
1.5.1 |
Affected products
- lettermint lettermint-node
Classification
- Weakness
-
- CWE-488 Exposure of Data Element to Wrong Session
References
-
github.com
/lettermint/lettermint-node/commit/24a17acbc2429c5eb30391f9df3dc0ea7aaf4de1
web, patch
-
github.com
/lettermint/lettermint-node/security/advisories/GHSA-49pc-8936-wvfp
web, mitigation, vendor-advisory
-
github.com
/lettermint/lettermint-node/blob/main/CHANGELOG.md#151-2026-02-20
web, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2026-27492
advisory
-
github.com
/lettermint/lettermint-node
package
Sources
- CVE List CVE-2026-27492
- GitHub Advisory GHSA-49pc-8936-wvfp
- NVD CVE-2026-27492
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.