PT-2026-21340 · Unknown · Lettermint Node.Js Sdk

Bjarn · Published 2026-02-20 · Updated 2026-02-24 · CVE-2026-27492

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Lettermint Node.js SDK versions 1.5.0 and below

Description The Lettermint Node.js SDK has an issue where email properties (to, subject, html, text, and attachments) are not reset between calls to the .send() function when the same client instance is reused. This can lead to data from a previous email being included in a subsequent email, potentially sending content or recipient addresses to unintended parties. Applications that send emails to different recipients sequentially, such as those used for password resets or notifications, are particularly susceptible. The issue occurs when reusing a single client instance across multiple .send() calls.

Recommendations Upgrade to version 1.5.1 or later. If upgrading is not immediately possible, create a new client instance for each .send() call.

Exploit

Fix

Weakness Enumeration

CWE-488

Related Identifiers

CVE-2026-27492

GHSA-49PC-8936-WVFP

Affected Products

Lettermint Node.Js Sdk

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27492.json · Exploit
• https://github.com/lettermint/lettermint-node/commit/24a17acbc2429c5eb30391f9df3dc0ea7aaf4de1 · Patch
• https://github.com/lettermint/lettermint-node/security/advisories/GHSA-49pc-8936-wvfp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27492 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-49pc-8936-wvfp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27492 · Security Note
• https://github.com/lettermint/lettermint-node/blob/main/CHANGELOG.md#151-2026-02-20 · Note
• https://github.com/lettermint/lettermint-node · Note
• https://reddit.com/r/VulnMatter/comments/1raarn5/resumen_diario_de_vulnerabilidades_20022026 · Reddit Post
• https://t.me/cveNotify/152720 · Telegram Post
• https://twitter.com/_cvereports/status/2025158723224617159 · Twitter Post
• https://t.me/CVEtracker/45379 · Telegram Post
• https://twitter.com/CVEnew/status/2025425469815075200 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2025206217765683311 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1rdh91b/resumen_diario_de_vulnerabilidades_24022026 · Reddit Post