CVE-2026-27492

The record

Lettermint Node.js SDK is the official Node.js SDK for Lettermint. In versions 1.5.0 and below, email properties (such as to, subject, html, text, and attachments) are not reset between sends when a single client instance is reused across multiple .send() calls. This can cause properties from a previous send to leak into a subsequent one, potentially delivering content or recipient addresses to unintended parties. Applications sending emails to different recipients in sequence — such as transactional flows like password resets or notifications — are affected. This issue has been fixed in version 1.5.1.

Affected packages

Related vulnerabilities

• GHSA-49pc-8936-wvfp Lettermint Node.js SDK leaks email properties to unintended recipients when client… Same vulnerability
• CVE-2026-114637 Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the… CWE-488
• CVE-2026-112921 Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter… CWE-488
• CVE-2026-84685 The react-native-auth0 SDK's web platform implementation does not scope its in-memory… CWE-488
• CVE-2026-86492 In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft… CWE-488
• CVE-2026-80231 A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given… CWE-488
• CVE-2026-82367 Exposure of Data Element to Wrong Session vulnerability in ash-project ash_graphql can… CWE-488
• CVE-2026-71850 Hono is a Web application framework that provides support for any JavaScript runtime. CWE-488