CVE-2026-27492: 
JavaScript vulnerability analysis and mitigation

CVE-2026-27492 is a state management flaw in the Lettermint Node.js SDK (npm package lettermint) where email properties — including recipient addresses (to), subject, html, text, cc, bcc, attachments, and others — are not reset between successive .send() calls when a single client instance is reused. This can cause sensitive email content or recipient addresses from one send operation to leak into a subsequent one, potentially delivering information to unintended parties. The vulnerability affects all versions of the lettermint npm package prior to 1.5.1 and was disclosed on February 20, 2026. It carries a CVSS v3.1 base score of 4.7 (Medium) (GitHub Advisory).

The root cause is classified as CWE-488 (Exposure of Data Element to Wrong Session): the EmailEndpoint class in src/endpoints/email.ts maintained a persistent this.payload object across multiple .send() invocations without resetting it after each call. Because the payload object accumulated state, any properties set during a prior send — such as recipient addresses, HTML body, attachments, or custom headers — would persist and be included in the next send if not explicitly overwritten by the caller. Exploitation requires that the application reuse a single Lettermint client instance across multiple .send() calls targeting different recipients, a common pattern in transactional email flows such as password resets or notification pipelines. The fix (commit 24a17ac) introduced a private reset() method that reinitializes this.payload to its default state and clears this.idempotencyKeyValue after each successful send, with the reset subsequently moved to a finally block to guarantee cleanup even on send failure (GitHub Advisory, Fix Commit).

The primary impact is a confidentiality breach: sensitive email content (e.g., password reset tokens, personal notifications, attachments) and recipient addresses from one user's email can be inadvertently delivered to a different, unintended recipient in a subsequent send. This is particularly severe in transactional workflows where emails are sent sequentially to different users, as it can expose private user data across account boundaries. There is no integrity or availability impact, and no lateral movement risk, but the data exposure risk is high in multi-user applications that reuse a single SDK client instance (GitHub Advisory).

There are no known public exploits, exploit kits, or evidence of in-the-wild exploitation of this vulnerability. The EPSS score is approximately 0.011% (0th percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is inherently limited by the local attack vector and high attack complexity, as it requires an attacker to have low-privileged access to an application that reuses a single Lettermint client instance across sequential sends to different recipients (GitHub Advisory).

Users should upgrade the lettermint npm package to version 1.5.1 or later, which introduces a reset() method that clears all email payload properties after each .send() call, including in error scenarios via a finally block (GitHub Advisory, Changelog). If an immediate upgrade is not possible, the recommended workaround is to instantiate a new Lettermint client for each individual send operation rather than reusing a single instance:

const client = new Lettermint({ apiKey: process.env.LETTERMINT_API_KEY });
await client.email.to('...').subject('...').html('...').send();

This ensures no state is carried over between sends and eliminates the risk of property leakage (GitHub Security Advisory).