4.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27492

CVE-2026-27492: Lettermint Node.js SDK leaks email properties to unintended recipients when client instance is reused

Impact

Email properties (such as to, subject, html, text, and attachments) are not reset between sends when a single client instance is reused across multiple .send() calls. This can cause properties from a previous send to leak into a subsequent one, potentially delivering content or recipient addresses to unintended parties. Applications sending emails to different recipients in sequence — such as transactional flows like password resets or notifications — are affected.

Patches

Yes, the issue has been patched. Users should upgrade to v1.5.1 or later.

Workarounds

If upgrading immediately is not possible, instantiate a new client for each send:

const client = new Lettermint({ apiKey: process.env.LETTERMINT_API_KEY });
await client.email.to('...').subject('...').html('...').send();

This ensures no state is carried over between sends.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27492

CVE-2026-27492:

4.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
lettermint	npm	< 1.5.1	1.5.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the lettermint-node SDK and allows for email properties to be leaked between sends when the same client instance is reused. The provided patch in commit 24a17acbc2429c5eb30391f9df3dc0ea7aaf4de1 clearly shows the fix. The file src/endpoints/email.ts is modified to add a reset() method to the EmailEndpoint class. This reset() method is then called within the send() method immediately after an email is sent. Before this change, the send() method did not clear the payload, causing any properties set for one email to persist for the next email sent with the same client instance. The vulnerable function is therefore EmailEndpoint.send, as it was responsible for the state not being cleared. The added test file src/endpoints/email.spec.ts further confirms this behavior by adding specific tests to ensure properties are reset between sends.

Vulnerable functions

EmailEndpoint.send

src/endpoints/email.ts

The 'send' method in the 'EmailEndpoint' class was vulnerable because it did not reset the email payload after an email was sent. This allowed properties from a previous send (like recipients, subject, and body) to be carried over to a subsequent send if the same client instance was reused, leading to potential data leaks.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.